NEWBIE - creating a simple JSP login page

Question

Hi guys,
I am really really stuck, and I would be so grateful if you guys could help me in any way. I am creating a simple application, but as part of the application i have to create a login / logout sub-application. It needs to verify the username and password by looking up a database in mySQL. I've had a look around on the internet to see if there is any simple way of doing it, but i can't understand most of it. I'm really new to JSP and only know how to do simple statement like <c:choose> and stuff like that. If anyone can help me in any way to create as simple a login / logout application that verifies the username and password from a database, I would be ever so grateful, thank you!
Just to let you know, the security-roles and all that stuff together with the <tomcat-users> stuff has already been set up.
I found this code by the author brain.compression, which seems to very useful, I've not tried it out yet, but was wondering, if somebody could help me split the code up into the separate JSP pages i will need, as I am not too sure which bits of the code need to go on what pages.
Thank you to anyone that can help me out and thanks for brain.compression for providing this code. I'm sorry for posting this in a forum not related to JSP, its just that I am a complete newbie to JSP and nobody in that forum is helping me.
brain.compression's code starts here...
First for the page you are requesting you would need a verify if the user is logged in or not:
<c:if test="${existingUser==null}">
<jsp:forward page="login.jsp">
<jsp:param name="origURL" value="${pageContext.request.requestURL}"/>
<jsp:param name="errorMsg" value="Please log in first" />
</jsp:forward>
</c:if>
This will redirect you to the login page:
<font color="red">
${fn:escapeXml(param.errorMsg)}
</p>
</font>
<form method="post" action="authenticate.jsp">
<table>
<tr>
<td>Please Enter the following information to log in:</td>
</tr>
</table>
<table>
<tr>
<td>User ID:</td>
<td><input name="userid" value="${fn:escapeXml(cookie.userid.value)}"></td>
</tr>
<tr>
<td>Password:</td>
<td><input type="password" name="password" value="${fn:escapeXml(cookie.password.value)}"></td>
</tr>
</table>
After that you have to verify with your DB if the login info provided is correct:
%-- Removing any scoped variables --%>
<c:remove var="existingUser" />
<c:if test ="${empty param.userid || empty param.password}" >
<c:redirect url="login.jsp">
<c:param name="errorMsg" value="Please enter a User Id and Password." />
</c:redirect>
</c:if>
<%-- Checking if User Id and Password are valid --%>
<sql:query var="anyvariable" dataSource="${data}">
SELECT * FROM table WHERE user_id = ? AND pass = ?
<sql:param value="${param.userid}"/>
<sql:param value="${param.password}"/>
</sql:query>
<c:if test="${anyvariable.rowCount == 0}">
<c:redirect url="login.jsp">
<c:param name="errorMsg" value="Invalid User Id or Password"/>
</c:redirect>
</c:if>
Also can somebody tell me if i am right. Do I need to create a page called login.jsp to put the actual form on, and a page called authenticate.jsp to verify the username and password are correct? Finally i see that brain.compression has used a variable called existingUser but has he actually declared it anywhere. Thanks again for anybody that can help me out!

Answer 1

i am still a jsp noobie but i have done some applications using html javascript php asp and other languages. What you want to do is take the data from the login form then compare that to the db see if it actually exist and has the correct info. From there you want to write a cookie to the users computer to hold the username and password, which will be checked for at the begining of every page verifying it in the database. This is how i have done password verification in the past and it works fairly well and unless your server gets hacked your pages should be secure.