What is used to save login information??

Question

I want to make a html page that has a login screen on it. My question is what is the correct way to store this information for later use. I thought of using a text file but that would not be secure. Also wouldn't a database have the same problem?? How does a web site like
E-bay handle customer login?

Answer 1

i used to use ldap till i decided to try the method in the ways mentioned here... for those interested, here's what i got: btw its pretty long and in some place very implmentation specific. Also i don't doc caus it bores me.
UserTable.java
package com.tempo.Schools;
import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Date;
import java.io.*;
import java.util.*;
public class UserTable implements Serializable
     private Connection connection;
     private PreparedStatement stmt;
     private ResultSet rset;
     private int id;
     private String username;
     private String name;
     private String password;
     private String email;
     private String date;
     private String lastpasschg;
     private String dateexpire;
     public void setId (int id) { this.id = id; }
     public int getId () { return id; }
     public void setUsername(String userid) { this.username = username; }
     public String getUsername() { return username; }
     public void setName(String name) { this.name = name; }
     public String getName() { return name; }
     public void setPassword(String password) { this.password = password; }
     public String getPassword() { return password; }
     public void setEmail(String email) { this.email = email; }
     public String getEmail() { return email; }
     public void setDate(String date) { this.date = date; }
     public String getDate() { return date; }
     public void setLastpasschg(String Lastpasschg) { this.lastpasschg = lastpasschg; }
     public String getLastpasschg() { return lastpasschg; }
     public void setDateexpire(String dateexpire) { this.dateexpire = dateexpire; }
     public String getDateexpire() { return dateexpire; }
     public UserTable(Connection connection)
          this.connection = connection;
     public void selectTable() throws SQLException
          stmt = connection.prepareStatement("SELECT * FROM USER_TABLE");
          rset = stmt.executeQuery();
     public void selectRowByID( int id ) throws SQLException
          stmt = connection.prepareStatement("SELECT * FROM USER_TABLE WHERE ID = ?");
          stmt.setInt(1, id);
          rset = stmt.executeQuery();
     public void selectRowByUsername( String userid ) throws SQLException
          stmt = connection.prepareStatement("SELECT * FROM USER_TABLE WHERE USERID = ?");
          stmt.setString(1, username);
          rset = stmt.executeQuery();
     public int selectNewID() throws SQLException
          stmt = connection.prepareStatement("SELECT USER_TABLE_SEQ.NEXTVAL FROM DUAL");
          rset = stmt.executeQuery();
          rset.next();
          int id = rset.getInt(1);
          rset.close();
          stmt.close();
          return id;
     protected int createUser() throws SQLException
          setId(selectNewID());
          if (getUsername().length()<5)
               return -1;
          PreparedStatement stmt = connection.prepareStatement("INSERT INTO USER_TABLE (ID, USERID, NAME, PASSWORD, EMAIL, DATECREATE, LASTPASSCHANGE, DATEEXPIRE)"
                                                  + " VALUES (?, ?, ?, ?, ?, TO_DATE('', 'YYYY-MM-DD'),TO_DATE('', 'YYYY-MM-DD'),TO_DATE('?', 'YYYY-MM-DD'))");
          stmt.setInt(1, getId());
          stmt.setString(2, getUsername());
          stmt.setString(3, getName());
          stmt.setString(4, getPassword());
          stmt.setString(5, getEmail());
          stmt.setString(6, getDateexpire());
          int result = stmt.executeUpdate();
          stmt.close();
          if (result==0)
               return 0;
          else
               return getId();
     protected int updateRowByID( int id ) throws SQLException
          stmt = connection.prepareStatement("UPDATE USER_TABLE ID = ?, USERID = ?, NAME = ?,"
                                   + "PASSWORD = ?, EMAIL = ?, DATECREATE = ?, LASTPASSCHG = ?, DATEEXPIRE = ?"
                                   + "WHERE ID = ?");
          stmt.setInt(1, id);
          stmt.setString(2, getUsername());
          stmt.setString(3, getName());
          stmt.setString(4, getPassword());
          stmt.setString(5, getEmail());
          stmt.setString(6, getDate());
          stmt.setString(7, getLastpasschg());
          stmt.setString(8, getDateexpire());
          stmt.setInt(9, id);
          return stmt.executeUpdate();
     protected boolean deleteRowByID( int id ) throws SQLException
          PreparedStatement stmt = connection.prepareStatement("DELETE FROM USER_TABLE WHERE ID = ?");
          stmt.setInt(1, id);
          int result = stmt.executeUpdate();
          stmt.close();
          if (result==0)
               return false;
          else
               return true;
     protected boolean changePassword(int id, String password) throws SQLException
          PreparedStatement stmt = connection.prepareStatement("UPDATE USER_TABLE SET PASSWORD = ? WHERE ID = ?");
          stmt.setString(1, password);
          stmt.setInt(2, id);
          int result = stmt.executeUpdate();
          stmt.close();
          if (result==0)
               return false;
          else
               return true;
    public boolean fetch() throws SQLException
        if ( rset.next() )
            setId(rset.getInt(1));
            setUsername(rset.getString(2));
            setName(rset.getString(3));
            setPassword(rset.getString(4));
            setEmail(rset.getString(5));
            setDate(rset.getString(6));
            setLastpasschg(rset.getString(7));
            setDateexpire(rset.getString(8));
            return true;
        else
            rset.close();
            stmt.close();
            return false;
    public void close()
SessionTable.java
package com.tempo.Schools;
import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Date;
import java.io.*;
import java.util.*;
public class SessionTable implements Serializable
     private Connection connection;
     private PreparedStatement stmt;
     private ResultSet rset;
     private int id;
     private String username;
     private String password;
     private String datelogon;
     public int getId() { return id; }
     public void setId(int id) { this.id = id; }
     public String getUsername() { return username; }
     public void setUsername(String userid) { this.username = username; }
     public String getPassword() { return password; }
     public void setPassword(String password) { this.password = password; }
     public String getDatelogon() { return datelogon; }
     public void setDatelogon(String datelogon) { this.datelogon = datelogon; }
     public SessionTable(Connection connection)
          this.connection = connection;
    public int createSession(String username, String password, String datelogon) throws SQLException
          if (username.length()<5)
               return 0;
          stmt = connection.prepareStatement("SELECT SESSION_TABLE_SEQ.NEXTVAL FROM DUAL");
          rset = stmt.executeQuery();
          rset.next();
          int id = rset.getInt(1);
          rset.close();
          stmt.close();
          setId(id);
          setUsername(username);
          setPassword(password);
          setDatelogon(datelogon);
          if (!addRow())
               return 0;
          return id;
    public boolean addRow() throws SQLException
          PreparedStatement stmt2 = connection.prepareStatement("INSERT INTO SESSION_TABLE (ID, USERID, PASSWORD, DATELOGON) VALUES (?, ?, ?, ?)");
          stmt2.setInt(1, getId());
          stmt2.setString(2, getUsername());
          stmt2.setString(3, getPassword());
          stmt2.setString(4, getDatelogon());
          int result = stmt2.executeUpdate();
          stmt2.close();
          if (result==0)
               return false;
          else
               return true;
    public void selectRowByUsername(String username) throws SQLException
          stmt = connection.prepareStatement("SELECT * FROM SESSION_TABLE WHERE USERID = ?");
          stmt.setString(1, username);
          rset = stmt.executeQuery();
    public void selectRowById(int id) throws SQLException
          stmt = connection.prepareStatement("SELECT * FROM SESSION_TABLE WHERE ID = ?");
          stmt.setInt(1, id);
          rset = stmt.executeQuery();
     public int deleteRowById(int id) throws SQLException
          PreparedStatement stmt2 = connection.prepareStatement("DELETE FROM SESSION_TABLE WHERE ID = ?");
          stmt2.setInt(1, id);
          int result = stmt2.executeUpdate();
          stmt2.close();
          return result;
    public boolean fetch() throws SQLException
        if ( rset.next() )
            setId(rset.getInt(1));
            setUsername(rset.getString(2));
            setPassword(rset.getString(3));
            setDatelogon(rset.getString(4));
            return true;
        else
            rset.close();
            stmt.close();
            return false;
    public void close()
SecurityTable.java
package com.tempo.Schools;
import java.sql.*;
import java.io.*;
import java.util.*;
public class SecurityTable implements Serializable
     private Connection connection;
     private PreparedStatement stmt;
     private ResultSet rset;
     private int id;
     private HashMap map = new HashMap();
     public HashMap getMap() { return map; }
     public int getId() { return id; }
     private void setId(int id) { this.id = id; }
     public SecurityTable(Connection connection)
          this.connection = connection;
     public void selectRowByID(int id) throws SQLException
          stmt = connection.prepareStatement("SELECT * FROM SECURITY_TABLE WHERE ID = ?");
          stmt.setInt(1, id);
          rset = stmt.executeQuery();
          parse();
    private void parse() throws SQLException
        if ( rset.next() )
            map.put("areamain_jsp", new Integer(rset.getInt(2)));
            map.put("FormPrint_sitevariations_jsp", new Integer(rset.getInt(3)));
            map.put("FormVer_sitevariations_jsp", new Integer(rset.getInt(4)));
            map.put("Form_sitedata_jsp", new Integer(rset.getInt(5)));
            map.put("Form_sitevariations_jsp", new Integer(rset.getInt(6)));
            map.put("noncontract_areamain_jsp", new Integer(rset.getInt(7)));
            map.put("noncontract_areamain1_jsp", new Integer(rset.getInt(8)));
            map.put("noncontract_sitemain_jsp", new Integer(rset.getInt(9)));
            map.put("siteaudits_jsp", new Integer(rset.getInt(10)));
            map.put("sitecarpet_jsp", new Integer(rset.getInt(11)));
            map.put("sitecarpetmod_jsp", new Integer(rset.getInt(12)));
            map.put("sitedata_jsp", new Integer(rset.getInt(13)));
            map.put("sitedataold_jsp", new Integer(rset.getInt(14)));
            map.put("sitefloordata_jsp", new Integer(rset.getInt(15)));
            map.put("sitemain_jsp", new Integer(rset.getInt(16)));
            map.put("siteohs_jsp", new Integer(rset.getInt(17)));
            map.put("siteperiodic_jsp", new Integer(rset.getInt(18)));
            map.put("siteperiodicedit_jsp", new Integer(rset.getInt(19)));
            map.put("siteperiodicprint_jsp", new Integer(rset.getInt(20)));
            map.put("siteplan_jsp", new Integer(rset.getInt(21)));
            map.put("siteplan_map_jsp", new Integer(rset.getInt(22)));
            map.put("siteqainspect_jsp", new Integer(rset.getInt(23)));
            map.put("sitevariations_jsp", new Integer(rset.getInt(24)));
            map.put("siteworksched_jsp", new Integer(rset.getInt(25)));
            map.put("siteworkschededit_jsp", new Integer(rset.getInt(26)));
            map.put("siteworkschedprint_jsp", new Integer(rset.getInt(27)));
            map.put("security_access", new Integer(rset.getInt(28)));
            map.put("admin_access", new Integer(rset.getInt(29)));
            map.put("report_access", new Integer(rset.getInt(30)));
            rset.close();
            stmt.close();
     protected int createUser(int id) throws SQLException
          stmt = connection.prepareStatement("INSERT INTO SECURITY_TABLE (ID) VALUES (?)");
          stmt.setInt(1, id);
          int result = stmt.executeUpdate();
          stmt.close();
          stmt = connection.prepareStatement("UPDATE SECURITY_TABLE SET " + access_defaults + "WHERE ID = ?");
          stmt.setInt(1, id);
          stmt.executeUpdate();
          stmt.close();
          if (result==0)
               return 0;
          else
               return id;
     protected void changeAccess(int id, String page, int access) throws SQLException
          Statement st = connection.createStatement();
          String query = "UPDATE SECURITY_TABLE SET " + page.toUpperCase() + " = "
               + Integer.toString(access) + " WHERE ID = " + Integer.toString(id);
          int result = st.executeUpdate(query);
     protected void deleteRowByID(int id) throws SQLException
          stmt = connection.prepareStatement("DELETE FROM SECURITY_TABLE WHERE ID = ?");
          stmt.setInt(1, id);
          stmt.executeUpdate();
     public void close()
     private static String access_defaults = "areamain_jsp = 15,"
                                             +"FormPrint_sitevariations_jsp = 1,"
                                             +"FormVer_sitevariations_jsp = 1,"
                                             +"Form_sitedata_jsp = 1,"
                                             +"Form_sitevariations_jsp = 1,"
                                             +"noncontract_areamain_jsp = 1,"
                                             +"noncontract_areamain1_jsp = 1,"
                                             +"noncontract_sitemain_jsp = , 1"
                                             +"siteaudits_jsp = 15,"
                                             +"sitecarpet_jsp = 15,"
                                             +"sitecarpetmod_jsp = 15,"
                                             +"sitedata_jsp = 5,"
                                             +"sitedataold_jsp = 1, "
                                             +"sitefloordata_jsp = 5,"
                                             +"sitemain_jsp = 1,"
                                             +"siteohs_jsp = 15,"
                                             +"siteperiodic_jsp = 15,"
                                             +"siteperiodicedit_jsp = 15,"
                                             +"siteperiodicprint_jsp = 1,"
                                             +"siteplan_jsp = 15,"
                                             +"siteplan_map_jsp = 1,"
                                             +"siteqainspect_jsp = 15,"
                                             +"sitevariations_jsp = 1,"
                                             +"siteworksched_jsp = 1,"
                                             +"siteworkschededit_jsp = 1,"
                                             +"siteworkschedprint_jsp = 1,"
                                             +"security_access = 0";
SecurityManager.java (i stuffed up on the name here)
package com.tempo.Schools;
import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Date;
import java.io.*;
import com.tempo.Schools.*;
import java.security.MessageDigest;
import java.util.*;
import com.tempo.utils.*;
public class SecurityManager implements Serializable
     //The connection
     private Connection connection;
     //User information for when logged in
     private int userid = 0;
     private String username = "";
     private boolean loggedIn = false;
     private int sessionid = 0;
     //Contains all access definitions
     private HashMap securityMap = null;
     //Allows info to be retieved
     public int getUserID() { return userid; }
     public String getUsername() { return username; }
     public boolean isLoggedIn() { return loggedIn; }
     public int getSessionid() { return sessionid; }
    public boolean getAccess(String key, int mask) throws Exception
          if (!isLoggedIn())
               throw new Exception("Cannot check access until login");
          Integer temp = (Integer)securityMap.get( key );
          int access = temp.intValue();
          if ((access & mask) == mask)
               return true;
          else
               return false;
     public SecurityManager(Connection connection)
          this.connection = connection;
      *Doesn't require password caus its already
      *been stored in the session table.
      *Does require a session id number as provided
      *by the logon function. Also returns the session id again
     public int logonFromSession(int sessionid) throws Exception
          UserTable ut = new UserTable(this.connection);
          SecurityTable st = new SecurityTable(this.connection);
          SessionTable session = new SessionTable(this.connection);
          session.selectRowById(sessionid);
          if (!session.fetch())
               return -1;
          String username = session.getUsername();
          String password = session.getPassword();
          ut.selectRowByUsername(username);
          if (!ut.fetch()) {
               //session.deleteRowById( sessionid );
               return -1;
          if (!ut.getPassword().equals(password)) {
               session.deleteRowById( sessionid );
               return -2;
          //License Expired
          //if(ut.getDateexpire() > Today's Date)
               //return -3;
          //Must change password
          //if (!ut.getLastpasschg more than 6 months ago
               //return -4
          this.sessionid = sessionid;
          this.userid = ut.getId();
          ut.close();
          st.selectRowByID( userid );
          securityMap = st.getMap();
          st.close();
          loggedIn = true;
          return getSessionid();
      *Call this function to log a user in.
      *returns a session id
     public int logon(String username, String password) throws Exception
          UserTable ut = new UserTable(this.connection);
          SecurityTable st = new SecurityTable(this.connection);
          SessionTable session = new SessionTable(this.connection);
          session.selectRowByUsername(username);
          while (session.fetch()) {
               session.deleteRowById( session.getId() );
          String encryptedPassword = SecurityTools.encrypt(password);
          ut.selectRowByUsername(username);
          //No Such User
          if (!ut.fetch())
               return -1;
          //Incorrect Password
          if (!ut.getPassword().equals(encryptedPassword))
               return -2;
          //License Expired
          //if(ut.getDateexpire() > Today's Date)
               //return -3;
          //Must change password
          //if (!ut.getLastpasschg more than 6 months ago
               //return -4
          this.sessionid = session.createSession(ut.getUsername(), encryptedPassword, "");
          session.close();
          this.userid = ut.getId();
          ut.close();
          st.selectRowByID( this.userid );
          securityMap = st.getMap();
          st.close();
          loggedIn = true;
          return getSessionid();
     public static void main(String[] args)
          try {
               //dbConnection dbc = new OracleConnection();
               //dbc.createConnection("peter");
               //dbc.close();
          } catch (Exception e) {
               e.printStackTrace();
SecurityTools.java
package com.tempo.Schools;
import java.security.MessageDigest;
import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Date;
import java.io.*;
import java.util.*;
import com.tempo.Schools.*;
import com.tempo.Schools.SecurityManager;
import com.tempo.utils.*;
public class SecurityTools implements Serializable
     private Connection connection;
     private SecurityManager sm;
     public SecurityTools(Connection connection, SecurityManager sm)
          this.connection = connection;
          this.sm = sm;
     public int addUser(String username, String name, String password, String email, String expire ) throws Exception
          if (!sm.isLoggedIn())
               throw new Exception("Must be logged in to create new account");
          if (!sm.getAccess("security_access", ADD))
               throw new Exception("You do not have access to create new account");
          connection.setAutoCommit(false);
          String encryptedPassword = encrypt(password);
          UserTable ut = new UserTable(connection);
          ut.setUsername(username);
          ut.setName(name);
          ut.setPassword(encryptedPassword);
          ut.setEmail(email);
          ut.setDateexpire(expire);
          int id = ut.createUser();
          if (id==0)
               throw new Exception("Could not add user");
          ut.close();
          SecurityTable st = new SecurityTable(connection);
          int id2 = st.createUser(id);
          if (id!=id2) {
               connection.rollback();
               throw new Exception("Something broke");
          st.close();
          connection.commit();
          //send email to person
          //send email to admin
          return id;
     public void deleteUser(int userid) throws Exception
          if (!sm.isLoggedIn())
               throw new Exception("Must be logged in to delete account");
          if (!sm.getAccess("security_access", DELETE))
               throw new Exception("You do not have access to delete account");
          UserTable ut = new UserTable(connection);
          ut.deleteRowByID(userid);
          ut.close();
          SecurityTable st = new SecurityTable(connection);
          st.deleteRowByID(userid);
          st.close();
     public void updateUserAccess(int id, String page, int access) throws Exception
          if (!sm.isLoggedIn())
               throw new Exception("Must be logged in to edit account");
          if (!sm.getAccess("security_access", EDIT))
               throw new Exception("You do not have access to edit account");
          SecurityTable st = new SecurityTable(connection);
          st.changeAccess(id, page, access);
          st.close();
     public boolean updateUserPassword(String username, String oldPassword, String newPassword) throws Exception
          if (!sm.isLoggedIn())
               throw new Exception("Must be logged in");
          String encrypted_oldPassword = SecurityTools.encrypt(oldPassword);
          UserTable ut = new UserTable(connection);
          ut.selectRowByUsername(username);
          //Incorrect Username
          if (!ut.fetch())
               return false;
          //Incorrect password
          if (!ut.getPassword().equals(encrypted_oldPassword))
               return false;
          return ut.changePassword( ut.getId(), SecurityTools.encrypt(newPassword) );
     public boolean changeUserPassword(String username, String newPassword) throws Exception
          if (!sm.isLoggedIn())
               throw new Exception("Must be logged in");
          if (!sm.getAccess("security_access", EDIT))
               throw new Exception("You do not have access to change password");
          UserTable ut = new UserTable(connection);
          ut.selectRowByUsername(username);
          //Incorrect Username
          if (!ut.fetch())
               return false;
          return ut.changePassword( ut.getId(), SecurityTools.encrypt(newPassword) );
     public static String encrypt(String plaintext) throws Exception
          MessageDigest md5 = MessageDigest.getInstance("MD5");
          md5.update( plaintext.getBytes("UTF-8"));
          byte[] buffer = md5.digest();
          String pw = new String(buffer);
          return Integer.toString(pw.hashCode());
     public static int VIEW = 1;
     public static int ADD = 2;
     public static int EDIT = 4;
     public static int DELETE = 8;
     public static int NOPRIV = 16;
     public static int UNPRIV = 32;
     public static int PRIV      = 64;
     public static int OPRIV  = 128;
}If your got this far and you need anyhelp, give me your email address and i'll lend what i can