JSP how to prevent hacking into password of login page

use a PREPARED statement for your sql code, here's one of mine:

this.st = this.conn.prepareStatement("UPDATE names SET FName = ?, sName = ?, Company = ?, mail = ?, Phone = ?, Password = ? WHERE mail = ?");

this.st.setString(1,fName);

this.st.setString(2,sName);

this.st.setString(3,company);

this.st.setString(4,nmail);

this.st.setString(5,phone);

this.st.setString(6,pwd);

this.st.setString(7,mail);

this.st.executeUpdate();

As you can see, in the sql values are represented by ?

These values are poulated with this.st.setString.

angrycata at 2007-7-14 0:51:05 >