why it checks just the last row of sql?

Question

hi, I use this method in my database class which checks the password and yahooId ,if they were correct it allows the user to go to the next frame .I have added a lot of yahooId and password in my sql but this method just checks the last row and allows the last person to go to the next frame.would you please help me? thanks.

  public static boolean Test(String userName, String password) {
    boolean bool = false;
    Statement stmt = null;
    try {
        stmt = conn.createStatement();

        ResultSet rst = null;

        rst = stmt.executeQuery("SELECT yahooId , password FROM clienttable");


        while (rst.next()) {
            if (rst.getString(1).equals(userName) && rst.getString(2).equals(password)) {
                bool = true;
                break;
            } else {
                bool = false;
            }
        }
    } catch (SQLException ex) {
        Logger.getLogger(Manager.class.getName()).log(Level.SEVERE, null, ex);
    }
    System.out.println(bool);
    return bool;



}

Answer 1

Don't select all the rows when you're interested in just one of them. Use a WHERE clause, which is its raison d'etre:

SELECT yahooId , password FROM clienttable WHERE yahooId=? AND password=?

If the result set is empty, authentication fails. If there's a single result, authentication succeeds. If there's more than one result, your dataset is munged (a UNIQUE index on yahooID is the proper way of preventing this).

The question marks, by the way, come from using prepared statements, if you haven't seen them before.

Answer 2

The problem is you're reading in the whole clienttable just to find a match for a specific user.

Instead, be VERY specific with your query to only look for a specific record that matches:

SELECT yahooId, password FROM clienttable WHERE yahooid = "UserName"

If that query returns a record, then you know the user exists. You can then check the password matches what is supplied to your method (I'm hoping you're not storing the password in plain text...).

This approach, enables you if you wanted to in the future, keep track of unsuccessful logon attempts to a user's account. And is much much more performant/scalable than loop round every record to find one match.