Simple Login and Session maintaining with Mysql

Question

Hi everybody,
I'm not expert in Java servlets and I'm writing and application that recognize users and maintain their session trough application's pages.
This application, after authentication, will displays a table coming from a query where I will have to modify only a "square" ( i Don't know the right english name for it,sorry...) of a row, more exactly the notes
I need a hand about Session and Login, and if you can post the code of a "row-selectionable" (to modify notes) query resulted table it will be very appreciated ;) (for the table, does'nt matter if it will be a Servlet or a JSP)
This is my actual Login code, but it doesn't works! (I tried to manage session reading some tutorials around the net)
package Login;
import java.sql.*;
import javax.servlet.http.*;
import javax.swing.JOptionPane;
* @author Alessio
* TODO To change the template for this generated type comment go to
* Window - Preferences - Java - Code Style - Code Templates
public class Login extends HttpServlet{
     private Connection con;
     private Statement st;
     private ResultSet rs,rs2;
     boolean autenticato= false;
     public void doGet(HttpServletRequest req,HttpServletResponse res) {
          try{
          Class.forName("com.mysql.jdbc.Driver");
          con=DriverManager.getConnection("jdbc:mysql://localhost:3306/gecoprova","root","argoilcane");
          HttpSession session=req.getSession(true);
          String sessione = session.getId();
          //APRE uno statement e con una query pesca dal DB tutte le tuple che hanno i dati passati allaservlet (nome, cognome,...)
          st=con.createStatement();     
          rs=st.executeQuery("SELECT * FROM anagrafe_procuratori WHERE ragsoc='"+req.getParameter("ID")+"'");
          //se il RESULTSET non � vuoto fa un check per vedere cosa restituisce RULES mentre nel frattempo pone 1 su LOGGED
          PreparedStatement updateProcuratore = con.prepareStatement("UPDATE privilegi_procuratore SET Logged=? WHERE (userid=? AND pass=?)");
          if(rs!=null){
               if(rs.next())try {
                    st=con.createStatement();
                    rs2=st.executeQuery("SELECT * FROM privilegi_procuratore WHERE (userid='"+req.getParameter("ID")+"' AND pass='"+req.getParameter("pass")+"' AND Logged=0)");
                    if(rs2!=null){
                         if(rs2.next())try {
                                      autenticato = true;
                                      String utente=req.getParameter("ID");
                                      String password=req.getParameter("pass");
                                      HttpSession s= req.getSession(true);
                                      Utente u =(Utente)s.getValue("Login.utente");
                                      if (u==null){
                                           u =new Utente (utente,password);
                                      else{
                                           u.ID=utente;
                                           u.pass=password;
                                      s.putValue("Login.utente",s);
                                        rs2.close();     
                                        con.close();
                                        updateProcuratore.close();
                                        }catch (Exception e){e.printStackTrace();}
                                             if (autenticato=true){               
                                             res.sendRedirect("RulezAmministration");
          else{
               res.sendRedirect("errorlogin.html");
               }catch (Exception e){e.printStackTrace();}
                              res.sendRedirect("errorlogin.html");
          else{
               res.sendRedirect("errorlogin.html");
          res.sendRedirect("errorlogin.html");
          catch(Exception e){
               try {
                    e.printStackTrace();
                    res.sendRedirect("errorlogin.html");
               catch(Exception e1){}
     public void doPost(HttpServletRequest req,HttpServletResponse res){
          try{
          HttpSession s=req.getSession(false);
          Utente u=(Utente)s.getValue("Login.utente");
          u.Logout();
          s.putValue("Login.utente",s);
          res.sendRedirect("index.htm");
               catch(Exception e1){}
public class RulezAmministration extends HttpServlet{
     private Connection con;
     private Statement st;
     private ResultSet rs;
     public void doGet(HttpServletRequest req,HttpServletResponse res){
          try{
               HttpSession s=req.getSession(false);
               if (s!=null){
                    Utente u= (Utente)s.getValue("Login.utente");
                    if (u!=null){
                         if (u.ID!=null){
                              res.sendRedirect("Inserimento.jsp");
                         else res.sendRedirect("errorlogin.html");
          catch(Exception e){}
     }

Answer 1

After you can use:
String utente=req.getParameter("ID");          
String password=req.getParameter("pass");
to get the ID and password, use a Database Access Object to communicate with the database. A sample block of code would something like:
Connection conn = null;
Context ctx = null;
DataSource ds = null;
try {
     DriverManager.registerDriver(new OracleDriver());
     String connectString = "jdbc:oracle:thin:@...";
               conn = DriverManager.getConnection(connectString, userName, password);
} catch (Exception e) {
e.printStackTrace();
Then,
statement = conn.createStatement();
resultSet = statement.executeQuery("select * from TABLE where Id = id and pass=password");
if it returns you a result, then, it means the login info is valid, you can set this info in a session object, like:
request.setSesion().setAttribute("login", "true");
Later on, in your application, you can chk whether the user has logon by
request.getSesion().setAttribute("login");
You should organize your code so that it separate different functions in your program.
Hope that helps.