server side validation problem

[nobr]Hi,

Trying to do server-side validation for a table with usernames, where if the username exists, a simple message in red is posted back to the JSP.

I was only able to get it to work if 1 (out of about 23) usernames was entered, because for some reason my results set, while being looped, was only returning 1 value all the time.

My servlet looks like the following, with a few if conditions to trigger the RequestDispatcher object appropriately.

publicclass ChangeControlUserAcctServletSPCallextends HttpServlet{

private Connection connection;

publicvoid doGet(HttpServletRequest request,

HttpServletResponse response)

throws IOException, ServletException{

//req parameters from html/jsp form(Admin) page

String username = request.getParameter("user_name_fld");

String userpwd = request.getParameter("user_pwd_fld");

String userrole = request.getParameter("user_role_fld");

String useremail1 = request.getParameter("usr_email1");

String useremail2 = request.getParameter("usr_email_suf");

String userfinemail = useremail1+useremail2;

String userbranch = request.getParameter("user_branch");

String errmsg ="";

String usernameret ="";

//boolean userexists = false;

HttpSession session = request.getSession();

try{

Class.forName("oracle.jdbc.driver.OracleDriver");

String dbURL ="jdbc:oracle:thin:@xxx.xxx.xx.xxx:1521:SID";

String usernm ="aaa_dfg";

String pwd ="********";

connection = DriverManager.getConnection(dbURL, usernm, pwd);

Statement stmt = connection.createStatement(ResultSet.TYPE_SCROLL_SENSITIVE, ResultSet.CONCUR_READ_ONLY);

String prepquer ="select user_name from users";

PreparedStatement preps = connection.prepareStatement(prepquer);

ResultSet rst = preps.executeQuery();

while (rst.next()){

usernameret = rst.getString(1);

if (usernameret.equals(username)){

errmsg ="<font face='arial' size='2'>This username</font>, <font face='arial' color='red' size='2'><b> " +username+" </b>,already exists. <br>"

+"Please enter another username.</font>";

session.setAttribute("message", errmsg);

RequestDispatcher dispatcher =

getServletContext().getRequestDispatcher(

"/chngctrl/admin/change_ctrl_users.jsp");

dispatcher.forward(request, response);

}

else{

CallableStatement cstmt = connection.prepareCall("{call cctrl_passwords_proc (?,?,?,?,?)}");

cstmt.setString(1,username);

cstmt.setString(2,userpwd);

cstmt.setString(3,userfinemail);

cstmt.setString(4,userrole);

cstmt.setString(5,userbranch);

cstmt.executeUpdate();

System.out.println("SQL Stmt: " +cstmt);

}

}

rst.close();

stmt.close();

}

if (username==null || username.equals("") || username.equals(" ")){

RequestDispatcher dispatcher =

getServletContext().getRequestDispatcher(

"/chngctrl/admin/change_ctrl_users.jsp");

dispatcher.forward(request, response);

System.out.print("first request");

}

elseif (usernameret.equals(username)){

errmsg ="This username, <font face='arial' color='red'>" +username+"already exists. <br>"

+"Please enter another email address.</font>";

session.setAttribute("message", errmsg);

RequestDispatcher dispatcher =

getServletContext().getRequestDispatcher(

"/chngctrl/admin/change_ctrl_users.jsp");

dispatcher.forward(request, response);

System.out.print("first request");

}

else{

RequestDispatcher dispatcher =

getServletContext().getRequestDispatcher(

"/chngctrl/insert_users_success.jsp");

dispatcher.forward(request, response);

System.out.print("2nd request");

}

}

}

publicvoid doPost(HttpServletRequest request,

HttpServletResponse response)

throws ServletException, IOException{

System.out.println("working here doPost method on Approval Servlet?");

doGet(request, response);

}

// final curly brace

}

Any feedback would be appreciated if you see something glaringly wrong, or just wrong in general! : )

Thanks![/nobr]

[6507 byte] By [bpropes20a] at [2007-10-3 4:34:06]
# 1

You must have both tabs and spaces in your code, because your post looks like

it was indented by chimpanzees wearing mittens. But if I understand it properly,

you read through all users. If the user ID matches what was entered, you tell

the user it doesn't. If it doesn't match, you call some stored procedure. Is that

right so far?

DrClapa at 2007-7-14 22:37:44 > top of Java-index,Database Connectivity,Java Database Connectivity (JDBC)...
# 2
correct. Sorry about the tab/space mess.
bpropes20a at 2007-7-14 22:37:44 > top of Java-index,Database Connectivity,Java Database Connectivity (JDBC)...
# 3
chimpanzees wearing mittens<chuckle/>Umm why are you processing this in Java and not just using a WHERE clause?like SELECT COUNT(*) FROM usertable WHERE username=?
cotton.ma at 2007-7-14 22:37:44 > top of Java-index,Database Connectivity,Java Database Connectivity (JDBC)...
# 4
How can this ever scale? If you had a million users in your database, you'd bring them all over the wire and iterate over each one of them, just to tell users that the name that gave as input didn't appear?cotton.m is correct - a WHERE clause is needed.%
duffymoa at 2007-7-14 22:37:44 > top of Java-index,Database Connectivity,Java Database Connectivity (JDBC)...
# 5

Had one (a WHERE clause) in there and later took it out, but I don't think I'd originally applied it correctly any way.

Are you saying just run a WHERE clause equivalent to the username request parameter, then make some boolean value that if it matches (and the boolean's true), reject it with some message? Therefore skipping over how ever many or few users are in there?

This has very few, but yeah, that's a better idea to trim that down were this (I don't see it doing so, but who knows, right?) ever to grow.

bpropes20a at 2007-7-14 22:37:44 > top of Java-index,Database Connectivity,Java Database Connectivity (JDBC)...
# 6
> If the user ID matches what was entered, you tell the user it doesn't. This is the part I was curious about. Are you really sure you meant to do that?
DrClapa at 2007-7-14 22:37:44 > top of Java-index,Database Connectivity,Java Database Connectivity (JDBC)...
# 7

> Had one (a WHERE clause) in there and later took it

> out, but I don't think I'd originally applied it

> correctly any way.

Apparently not.

>

> Are you saying just run a WHERE clause equivalent to

> the username request parameter, then make some

> boolean value that if it matches (and the boolean's

> true), reject it with some message?

I'll admit that I didn't read your code (too much trouble), but it sounds like you're trying to validate a given user who has supplied a username (and maybe a password?) that's unique to them. You query your database for that username. If it doesn't appear, they can't come in. If the username appears but the password is wrong, they can't come in. If both match, you give them a credential or token of some kind that tells all your other pages "This person is all right."

> Therefore skipping over how ever many or few users are in there?

You only want to transfer the one you need over the wire, and you only want to check the one that has a chance of matching the password. Why bother with a million other users if the username is unique?

> This has very few, but yeah, that's a better idea to

> trim that down were this (I don't see it doing so,

> but who knows, right?) ever to grow.

I'd get it deployed and working before I'd worry about it growing.

%

duffymoa at 2007-7-14 22:37:44 > top of Java-index,Database Connectivity,Java Database Connectivity (JDBC)...
# 8
> I'd get it deployed and working before I'd worry about it growing.But that's still no excuse for doing chuckleheaded things. Design it right, even if your user base is small.%
duffymoa at 2007-7-14 22:37:44 > top of Java-index,Database Connectivity,Java Database Connectivity (JDBC)...