Why can't I use the word "faces" in my url-mapping?

Question

I am trying to get a servlet to work for the url /faces/inloggen but I cannot get it to work. Anything without the word faces in it will work.
I simply want this tag to work:
    <servlet-mapping>
        <servlet-name>LoginServlet</servlet-name>
        <url-pattern>/faces/inloggen</url-pattern>
    </servlet-mapping> The servlet reads a username and password from a database and should eventually redirect to the correct page.
Does the order in which the mappings appear in the web.xml matter?

Answer 1

Hm, that also means I have no faces context in my servlet, which makes it kinda hard to look in the database for the password.
How should I go about this then? I tried using Lucas Jellema's login module but it has this weird bug which makes every username containing 'OR' impossible to use because of sqlinjection (yes, even if there's no spaces around it).
I figured I could write my own servlet and let it handle my logins but apparently that's not how it's done. Any help would be appreciated!
Edit:
In the howtos I find the following comment:
// SQL INJECTION DETECTION
// Detects and reports SQL injection attempts. The following code logs all attempts to enter
// SQL commands like create, drop, update, delete, insert, hexadecimal encoded characters etc.
// and immediately returns false
Pattern p = Pattern.compile("(?i)\\bselect|create|insert|delete|drop|update|or|%.\\d\\b");
Matcher m = p.matcher(username);
if (m.find())
    //someone tries to break into this application and should be tracked back
    log("SQL Injection attempt detected: username was altered to include SQL keyword: "+m.group(),LOG_AUTH);
    return false;
All database LoginModules that perform authentication based on user and role tables contain this code snippet. The regular expression can be extended to filter even more SQL key words if needed.That's great! How do I change that regexp so that I can use usernames containing 'OR'? This is a real problem for us....
Message was edited by:
Wendy Tromp