User Authentication Mechanism

Question

Hi All.
I have some piece of code that I need your opinion of:
It is deliberately "elongated" to show a bit of detail. Here we go then
public boolean login(String usernameGiven, String passwordSupplied)
        try
            // Declare some constant values
            final String user = this.database_user;
            final String password = this.database_password;
            int resultCount = 0;
            // check for blank values
            if ((usernameGiven.trim().length() == 0) || (usernameGiven == null) || (passwordSupplied.trim().length() == 0) || (passwordSupplied == null))
                throw new java.lang.NullPointerException("Invalid username or password!");
            // we now connect to MySQL
            Class.forName("com.mysql.jdbc.Driver").newInstance();
            Connection connection = DriverManager.getConnection("jdbc:mysql://localhost/access?", user, password);
            Statement statement = connection.createStatement();
            String query = "SELECT * FROM users WHERE username='" + usernameGiven + "' AND password=MD5('" + passwordSupplied + "')";
            ResultSet rs = statement.executeQuery(query);
            // Get the results
            while (rs.next())
                String name = rs.getString("username");
                int flag = rs.getInt("flag");
                resultCount++;
                if (rs.getString("username").trim().length() != 0)
                    return true;
                if (resultCount != 1)
                    return false;
            connection.close();
        catch (Exception e)
            return false;
        return false;
    }Thats the method. The aim of which is to authenticate users. What I had in mind is this:
1. The username is unique
2. Each username must be accompanied by a password
3. The passwords may not necessarily have to be unique
So if a user supplies a username and a password, there maybe one and only one match for the username and password supplied.
If there is a match, only one result row gets returned. And if one row is returned, we have a "true" boolean value, else we have a "false".
Thus my question is, is this the best way to go about it?

Answer 1

I assume that, if username is unique then you also have a unique constraint on the table to make sure this is always true. If so then you really don't need to fetch the data from the cursor because the rs.next() will fail if the username and password are incorrect. You can simplifiy your code to
ResultSet rs = statement.executeQuery(query);
boolean found = rs.next();
rs.close();
statement.close();
connection.close();
return found;You may even want to change "SELECT * FROM ..." with "SELECT 1 FROM ..." so the database driver doesn't have to read a bunch of unnecessary data. I doubt you will notice any performance difference but it may make the code easier to maintain.
Or, if you now how to create a stored procedure you can move the SQL into the procedure (passing it the username and password as parameters) and have it simply return a 1 if found or 0 if not. This will allow the database to skip the parse operation and result in even less network traffic. This also puts your authenticaton logic into a central location that can be called from different client apps, if necessary.
Also, just FYI, you should check if username and password are null before checking if the length is zero. If it is null the length check will throw a null pointer exception. If you reverse these the null check will be true and the length check won't be performed.