Problems with query on a DB using NetBeans Tomcat and MySql

Question

hi,
I've wrote a servlet that receive uername and password from a jsp. By quering to the db the servlet verify if that user is present on the db. I've notice no errors, hovever the page displayed is the same even if the user is present on db or isn't present. Here is the class, the context.xml and the web.xml
import java.sql.*;
import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
public class Main extends HttpServlet
public void doGet (HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException
String driver = "com.mysql.jdbc.Driver";
String url = "jdbc:mysql://localhost:3306/esempio3";
int num = 0;
String jspPage = "";
String user, pass;
user = request.getParameter("username");
pass = request.getParameter("password");
try
Class.forName(driver).newInstance();
Connection connessione = DriverManager.getConnection(url,"root", "admin");
if(connessione == null)
throw new SQLException();
Statement statement = connessione.createStatement();
String SQL = "SELECT ID As num FROM Utenti WHERE Username='"+user+"' AND Password='"+pass+"'";
ResultSet risultato = statement.executeQuery(SQL);
num = risultato.getInt("num");
connessione.close();
catch(Exception e)
jspPage = "/error.jsp";
if ( num > 0 )
jspPage = "/Welcome.jsp";
else
jspPage = "/NoFound.jsp";
request.getRequestDispatcher( jspPage ).forward(request,response);
THE WEB.XML FILE:
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
<description>bla bla</description>
<display-name>esempiooo</display-name>
<servlet>
<servlet-name>Main</servlet-name>
<servlet-class>Main</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>Main</servlet-name>
<url-pattern>/Main</url-pattern>
</servlet-mapping>
<session-config>
<session-timeout>
30
</session-timeout>
</session-config>
<welcome-file-list>
<welcome-file>index.html</welcome-file>
</welcome-file-list>
<resource-ref>
<description>jdbc:mysql://localhost:3306/esempio3</description>
<res-ref-name>jdbc/Esempio3</res-ref-name>
<res-type>javax.sql.DataSource</res-type>
<res-auth>Container</res-auth>
</resource-ref>
</web-app>
THE CONTEXT.XML FILE
<?xml version="1.0" encoding="UTF-8"?>
<Context path="/Esempio3">
<Resource name="jdbc/Esempio3" auth="Container" type="javax.sql.DataSource"
maxActive="100" maxIdle="30" maxWait="10000"
username="root" password="admin" driverClassName="com.mysql.jdbc.Driver"
url="jdbc:mysql://localhost:3306/esempio3"/>
</Context>
Could someone help me?
thanks

Answer 1

Hi,
the SQL string formed in that way complile, but the string in the way you said does't compile. I tryed to use PreparedStatement without succes. The result is the same. Here is the code:
String SQL = "select ID from Utenti where USERNAME=? and PASSWORD=?";
PreparedStatement pre = connessione.prepareStatement(SQL);
pre.setString(1, user);
pre.setString(2, pass);
ResultSet risultato = pre.executeQuery(SQL);
Thank you very much for your help