Re: Login Authentication against database...

Miao, Franco CAWS:EX Wed, 14 Nov 2001 13:21:13 -0800

Title: Message

Actually that what I have been doing, but in my SQL database end, user password still show up the real password.

Franco Miao

Technology Operation Analyst
Information Systems Branch
Ministry of Community, Aboriginal & Women's Services &
Ministry of Agriculture, Food & Fisheries
ph: (250) 952-6734 pager: (250) 413-9457

-----Original Message-----
From: Syed Rehman [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, November 14, 2001 1:18 PM
To: [EMAIL PROTECTED]
Subject: Re: Login Authentication against database...

Hello Miao:

Use the type "password" in your HTML code for the input text box.

Syed

-----Original Message-----
From: Miao, Franco CAWS:EX [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, November 14, 2001 1:24 PM
To: [EMAIL PROTECTED]
Subject: Re: Login Authentication against database...

I understand the UserPassword field in database sever will show the exact character, is it possible to display **** ?

Franco

Franco-----Original Message-----
From: Praveen Potineni [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, November 14, 2001 11:20 AM
To: [EMAIL PROTECTED]
Subject: Re: Login Authentication against database...

That's exactly what i did. I got only one record and test if the user exist. Else it goes to login screen.

But i still get the same error. Well i figured that i'm getting problem comparing the 2 strings...

string coming out of database and the string entered by user. Can u check the code and suggest me on this...

Thanks in advance

Praveen

   String sqlStr = "SELECT * FROM SAMM.UsersLogin WHERE UserLoginId = '"+username+"' AND UserPassword = '"+password+"'";
   stmt = myConn.createStatement();
   myResultSet = stmt.executeQuery(sqlStr);
   if(myResultSet.next() == false)
   {
    log("resulset is null.");
   }
   else{
    log("resultset is true");

    String uid = myResultSet.getString("UserLoginId");
    String upin = myResultSet.getString("UserPassword");

    if ((username.equalsIgnoreCase(uid)) && (password.equalsIgnoreCase(upin))){
      validUser = "true";
    }
    else{
      validUser = "false";
    }
    log("validUser is : " +validUser);
   }
   myResultSet.close();
   stmt.close();
  }
  catch(SQLException sqle){
   //System.out.println("User Does not exist Exception: +sqle.toString()");
   //log("DBObject.validUserExists: Exception: "+sqle.toString());
  }
  return validUser;
}

----- Original Message -----

From: Joe Cheng

To: [EMAIL PROTECTED]

Sent: Wednesday, November 14, 2001 1:45 PM

Subject: Re: Login Authentication against database...

Praveen-

It looks like your query is retrieving the whole set of users and then iterating in Java to see if any of them match the username/password the user entered. Why would you do that, rather than simply:

SELECT * FROM users WHERE username = '<username entered by user>' AND password = '<password entered by user>';

and see if any rows are returned. If there are no rows, the username and/or password was wrong. This way you don't have to deal with so much data, making it potentially much faster and less memory intensive.

-jmc

Re: Login Authentication against database...

Reply via email to