基于Oracle数据库的Servlet登录页凭证匹配循环逻辑问题

Hey there! I see exactly what's tripping up your login code right now. The problem is that your current logic outputs "未找到" as soon as it hits the first non-matching record, even though there might be a valid user later in the result set. Let's fix this properly.

What's Wrong with the Current Code? #

Your current loop checks each row one by one, and if the first row doesn't match, it immediately prints "未找到" before continuing to check other rows. That's why you're seeing that premature message—you shouldn't declare the user as not found until you've checked all records in the result set.

Corrected Approach #

Here's how to adjust your logic:

1. Use a boolean flag to track whether we found a matching user.
2. Only handle the "未找到" case after we've finished looping through all rows.
3. Also, let's add some critical security and resource management best practices.

Modified Code Snippet #

// Assume you've established your database connection safely
// Use parameterized query to avoid SQL injection (critical security fix!)
String query = "SELECT column1, column2, user_id, password FROM your_users_table WHERE user_id = ?";
PreparedStatement pstmt = conn.prepareStatement(query);
pstmt.setString(1, uname); // Bind the username parameter
ResultSet rs = pstmt.executeQuery();

boolean userFound = false;

while (rs.next()) {
    // Use column names instead of indexes for better readability and maintainability
    String id = rs.getString("user_id");
    String password = rs.getString("password");
    
    if (id.equals(uname) && password.equals(psw)) {
        userFound = true;
        out.println("Found");
        
        // Set up user session and redirect to home page
        HttpSession session = request.getSession();
        session.setAttribute("Userid", id);
        response.sendRedirect("home.html");
        break; // Exit loop immediately once we find the matching user
    }
}

// Only print "未找到" if we checked all rows and found no match
if (!userFound) {
    out.println("未找到");
}

// Clean up database resources to prevent leaks (use try-with-resources for auto-cleanup in Java 7+)
rs.close();
pstmt.close();
conn.close();

Key Best Practices to Follow #

• Parameterized Queries: Always use PreparedStatement instead of raw Statement to block SQL injection attacks—this is non-negotiable for secure login systems.
• Resource Management: Never leave database connections, statements, or result sets open. Using try-with-resources syntax (try (Connection conn = ...) { ... }) will auto-close these resources for you.
• Separate Logic and View: Avoid using out.println() directly in servlets. Instead, forward to a JSP page (like loginError.jsp) to handle error messages—this keeps your code organized.
• Password Security: Never store plain-text passwords in your database. Hash passwords with a strong algorithm like BCrypt before saving them, and verify the hash during login instead of comparing plain strings.

内容的提问来源于stack exchange，提问作者Anuj Kis Kishor