Java sql database login

Question

I am having problem with database, creating a login screen that has 1 choice box, 1 textfield for username, 1 jpasswordfield for password. Database name-admin(username text,password text)

It's showing an error. How can I fix this.

Here is my code:

if(choice.getSelectedIndex()==1)
{
  try {
      String sql ="SELECT password FROM admin WHERE username = ? AND password = ?";
      pst = con.prepareStatement(sql);
      pst.setString(1, UserName.getText());
      /*Showing: "The method setString(int, String) in the type
        PreparedStatement is not applicable for the arguments (int, char[])*/
      pst.setString(2,passwordField.getPassword());
    }
    catch(Exception e) {
     JOptionPane.showMessageDialog(null, e);
    }
}

Tim Biegeleisen · Accepted Answer · 2018-01-02 12:45:40Z

5

Convert the char[] array to a string before passing it to the statement:

String sql = "SELECT password FROM admin WHERE username = ? AND password = ?";
pst = con.prepareStatement(sql);
pst.setString(1, UserName.getText());
pst.setString(2, new String(passwordField.getPassword()));

If you have a look at the Javadoc, you will see that one of the String constructors in fact accepts a char[] as the input.

answered Jan 2, 2018 at 12:45

Tim Biegeleisen

526k32 gold badges324 silver badges399 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Mick Mnemonic Over a year ago

If the intention is to use char[] to prevent the password from ending up in the string pool in JVM's memory, then this solution will void that intention (by creating a new String). An alternative solution would be to set a character stream on the statement, as exemplified in this aswer. This of course requires that the JDBC driver doesn't eventually create a String out of the array.

Tim Biegeleisen Over a year ago

@MickMnemonic Good comment, I have never heard of this concern before. But there is an even bigger problem apparently, namely that the OP is storing cleartext passwords in the database. Instead we should be hashing the char[] and then passing this to the statement (I think).

Mick Mnemonic Over a year ago

I agree, plaintext passwords in the DB are a much bigger concern in real life scenarios.

jcoder8 · Accepted Answer · 2018-01-02 13:33:46Z

0

You can use this:

pst.setString(2,String.valueOf(passwordField.getPassword()));

The method getPassword() returns chararray and you need a String.

Best

answered Jan 2, 2018 at 13:33

jcoder8

1932 silver badges10 bronze badges

Collectives™ on Stack Overflow

Java sql database login

2 Answers 2

3 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related