SQL特定查询下If语句的Else分支无法生效问题求助

Hey there! Let's figure out why your else branch isn't working and go over better (and safer) ways to write your database query for PIN validation.

First, Why Your Else Branch Isn't Triggering #

The root problem isn't exactly your query syntax—it's how you're handling the ResultSet:

• When there's no matching PIN in the database, your SELECT query returns an empty result set. That means the while (rs.next()) loop never runs at all, so neither your if nor else block gets executed. Your PinCheck variable stays at its default value (probably null or empty), making it seem like the else isn't working.
• Even when there is a match, looping through results is unnecessary here—your query already filters for the exact PIN, so you only need to check if any result exists.

Alternative (and Better) Query Approaches #

1. Use PreparedStatement (Recommended)

This is the safest way to write database queries in Java—it prevents SQL injection attacks and avoids syntax errors from special characters in the PIN.

public void getOperation() {
    Connection conn = null;
    PreparedStatement pstmt = null;
    ResultSet rs = null;
    try {
        // Load driver
        Class.forName("com.mysql.jdbc.Driver");
        // Establish connection
        conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/customerdb", "user", "@1234@");
        
        // Parameterized query (uses ? as a placeholder for the PIN)
        String query = "SELECT pin FROM customerdetails WHERE pin = ?";
        pstmt = conn.prepareStatement(query);
        pstmt.setString(1, Pin); // Bind the PIN value to the placeholder
        
        rs = pstmt.executeQuery();
        
        // Check if we found a matching PIN
        if (rs.next()) {
            PinCheck = "Pin OK";
        } else {
            // No matching record = invalid PIN
            PinCheck = "Invalid Pin";
        }
    } catch (ClassNotFoundException e) {
        e.printStackTrace();
        PinCheck = "Error: Database driver not found";
    } catch (SQLException e) {
        System.err.println(e);
        PinCheck = "Error: Database connection failed";
    } finally {
        // Properly close resources in reverse order
        try {
            if (rs != null) rs.close();
            if (pstmt != null) pstmt.close();
            if (conn != null) conn.close();
        } catch (SQLException e) {
            e.printStackTrace();
        }
    }
}

2. If You Must Use Statement (Not Recommended)

If you need a direct equivalent to your original query (though we strongly advise against this due to SQL injection risk), you could use string formatting—but be aware this is unsafe:

String query = String.format("SELECT pin FROM customerdetails WHERE pin='%s'", Pin);

Note: If your PIN contains single quotes (e.g., 12'34), this will break your query and open you up to SQL injection.

Key Fixes & Improvements #

• Handles empty result sets: Now the else branch triggers when no matching PIN is found, which is what you were missing originally.
• Prevents SQL injection: PreparedStatement is non-negotiable for user-supplied values like PINs.
• Proper resource cleanup: Closing ResultSet, Statement, and Connection in the finally block prevents database connection leaks.
• Simpler logic: No need to compare the retrieved PIN again—your query already filters for the exact value, so a result exists means the PIN is valid.

内容的提问来源于stack exchange，提问作者Sanju