How to allow a user to view records belonging to them only...!

Question

Hi guys,
I have a login page written in jsp. When users login, the login servlet check for username and password, then it takes them to a main page. From the main page, users can decide to view all the records that they have already submitted by clicking on the "view" button.
So far, right now when users click on that "view" button, they are able to view all the records in the database and that's not what I want. I want users to only view the records they have submitted.
Does anyone know how to do...??
Thanks...

Answer 1

Yeah...right...
public void doGet (HttpServletRequest request, HttpServletResponse response)
             throws ServletException, IOException {
           String username = request.getParameter("username");
           String password = request.getParameter("password");
           if (login (request, response, username, password)) {
                response.sendRedirect("/WepApplication/Files.jsp");     
        public void doPost (HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
           doGet(request, response);
        public boolean login (HttpServletRequest request, HttpServletResponse response, String user, String password)
        throws ServletException, IOException{
           try {
              Statement statement = connection.createStatement();
              String sql = "SELECT userID, login FROM User" + " WHERE login='" + user + "'" + " AND pass='" + password + "'";
              ResultSet resultSet = statement.executeQuery(sql);
              if (resultSet.next()) {
                  int userId = resultSet.getInt(1);
                  String id = Integer.toString(userId);
                  HttpSession session = request.getSession();
                  session.setAttribute("user", id);
                  System.out.println("user is = " + session.getAttribute("user"));
                 resultSet.close();
                 statement.close();
                 return true;
              resultSet.close();
              statement.close();
           } catch (SQLException e) {
              System.out.println (e.toString());
           } catch (Exception e) {
              System.out.println (e.toString());
           return false;
        }