com.microsoft.sqlserver.jdbc.SQLServerexception:incorrect syntax near'='

Question

I'm getting the error in the first line i guess! Please help me out in dealing with it. I'm basically trying to execute a query through my front end

try {            
        ResultSet rs=st.executeQuery("select *from Login Username ='"+username+"' and Password  '"+password+"'");
        rs.last();
        int counter = rs.getRow();
        if (counter==1){
            JOptionPane.showMessageDialog(null,"Username and Password Correct","Username and Password Correct",JOptionPane.INFORMATION_MESSAGE);

            this.setVisible(false);
            new Menu().setVisible(true);
            hide();
            }else{
            jt_username.setText("");
            jp_password.setText("");
            JOptionPane.showMessageDialog(null,"Error","Username and Password Incorrect",JOptionPane.INFORMATION_MESSAGE);            
        }
    }
    catch (SQLException ex) {
        JOptionPane.showMessageDialog(null, ex);
    }

I've replaced my code with where statement but now its showing this com.microsoft.sqlserver.jdbc.SQLServerexception:incorrect syntax near". — Talha Malik
– Talha Malik, Commented Dec 28, 2013 at 19:14
There are four things wrong that I can see. (1) You shouldn't store passwords in plain text, hash them. (2) Missing WHERE between Login and Username (3) missing an = after Password. (4) vulnerable to SQL injection. Use parameterised queries. — Martin Smith
– Martin Smith, Commented Dec 28, 2013 at 19:36
Thank you very much for your help I've sorted out the error and now its working perfectly fine :) — Talha Malik
– Talha Malik, Commented Dec 28, 2013 at 19:45
If all you have done is fixed the syntax errors it is not working fine. It will break for passwords/user names containing single quotes. And this will also allow SQL injection allowing your login to be entirely bypassed (or worse). — Martin Smith
– Martin Smith, Commented Dec 28, 2013 at 19:47

Mureinik · Accepted Answer · 2015-11-03 16:37:15Z

3

Your SQL is missing the WHERE keyword. Try this on for size:

ResultSet rs=st.executeQuery("select * from Login WHERE Username ='"+username+"' and Password=  '"+password+"'");

edited Nov 3, 2015 at 16:37

answered Dec 28, 2013 at 19:41

Mureinik

316k54 gold badges402 silver badges406 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Martin Smith Over a year ago

Please show how to perform parameterised queries in your answer. There is no value in just fixing the trivial syntax errors.

Collectives™ on Stack Overflow

com.microsoft.sqlserver.jdbc.SQLServerexception:incorrect syntax near'='

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related