tags:

views:

21

answers:

1

I want to retieve username from database, but it gives empty page. What is wrong in my code?

<html>
<head>
<title>verification</title>
</head>
<body>     
       <%@ page import = "java.io.*" %>
       <%@ page import = "java.sql.*" %>
       <%@ page import = "java.lang.*" %>
       <%
             String eid = request.getParameter("eid");
             String Pwd = request.getParameter("Pwd");

               String db_username = "root";
               String db_password = "sarat";
               String db_url = "jdbc:mysql://localhost/empdb";
               String Driver = "com.mysql.jdbc.Driver";

         try
          {  
               Class.forName(Driver);   
   Connection con = DriverManager.getConnection(db_url,db_username,db_password);

             Statement st = con.createStatement();

String sql = "select username from user where userid = 'eid' and password = 'Pwd' ";
               ResultSet rs = st.executeQuery(sql);
                   while(rs.next())
                   {
                     out.println(rs.getString(1));
                      out.println("<br/>");                          
                    }
           st.close ();
           con.close();            
         }             
        catch(Exception e)
         { 
           out.println(e);
          e.printStackTrace();  
          }
%>          

</body>
</html>
+1  A: 

Try:

String sql = "select username from user where userid = '"+eid+"' and password = '"+Pwd+"' ";

But you also need to read up on little Bobby Tables and his SQL Injection Attacks.

Borealid