login page automatically redirects to else case

Question

this code shud check login credentials and forward either to logged in page for admin when getParameter(7)=1 or to customer when it is 0.. if login credentials are not correct it will go to error messages and fromt her to login page again.. but somehow it is directly going to errorpage in else case if its not admin!! next two cases are not being checked at all!!

protected void doPost(HttpServletRequest request, HttpServletResponse response) throws     ServletException, IOException {
    try
    {
    Class.forName("com.mysql.jdbc.Driver");
    Connection con =      DriverManager.getConnection("jdbc:mysql://localhost:3306/mutualfund", "root", "");
    Statement stmt = con.createStatement();
    ResultSet result = stmt.executeQuery("SELECT * FROM login_table;");
    String uname= request.getParameter("username");
    String pass= request.getParameter("password");

    while(result.next())
    {
        if(result.getString(1).equals(uname) && result.getString(2).equals(pass))
                {
                 if(result.getBoolean(7)==true)
                 {
                       response.sendRedirect("displayFunds.jsp");
                 }
                 if((result.getBoolean(7)==false) && (result.getString(4).equals("")))
                 {
                     response.sendRedirect("changePassword.jsp?name="+uname+"&&pass="+pass);

                 }
                 if((result.getBoolean(7)==false) &&     (!result.getString(4).equals("")))
                 {
                     response.sendRedirect("custProfile.jsp");
                 }
                }
        else 
        {


                response.sendRedirect("loginFailed.jsp");  
        }

    }
    }
    catch (Exception ex) {
        Logger.getLogger(Admin.class.getName()).log(Level.SEVERE, null, ex);
    }

}
}

You should first remove the "==true" and "==false" pieces of code. If something is true you don't need to ensure that is really true by comparing again with true value. — br araujo, Jun 12 '13 at 18:01

score 1 · Accepted Answer · edited Jun 20 '20 at 09:12

You're not returning from the method, but continuing to iterate through the while loop. You seem to expect that a simple method call response.sendRedirect() magically aborts the whole while loop and returns from the method. It doesn't do that. The code just continues the loop, checking the next user and setting the redirect URL, hereby overriding the previous one.

You need to return from the method yourself.

response.sendRedirect(someURL);
return;

Your concrete problem is caused because your login doesn't match the last user entry in the DB.

Unrelated to the concrete problem, this approach is however terribly inefficient. You're not taking benefit of the powers of a relational database and instead copying the entire DB table into Java's memory and performing the comparison in Java. You should be writing SQL queries in such way that it returns exactly the information you need. In this particular case, you should be using the SQL WHERE clause instead (in a prepared statement!), so that the resultset contains exactly zero or one row.

if (resultSet.next()) {
    // Login OK!
} else {
    // Login fail!
}

Further, your code is also leaking DB resources by never closing them. You should be closing them in finally. Also, loading the JDBC driver on every HTTP request is unnecessary. Just load it once during webapp's/servlet's startup.

login page automatically redirects to else case

1 Answers1

See also: