Databases
StackOverflow2013
Postsdbo
POHow can I secure a JSP page after adding it to my hosting and making it live?
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POHow can I secure a JSP page after adding it to my hosting and making it live?
    text
    copied!<p>I have a very basic login JSP that passes the variables to the servlet and checks from a MySQL DB if the username and password are available. Is this secure enough to use on a website, or does it need more security? If so, how to make it more secure? </p> <p>This is the servlet:</p> <pre><code>import java.io.*; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.*; import java.sql.*; /** * Servlet implementation class loginServlet */ @WebServlet("/loginServlet") public class loginServlet extends HttpServlet { private static final long serialVersionUID = 1L; /** * @seeHttpServlet#HttpServlet() */ public loginServlet() { super(); // TODOAuto-generated constructor stub } /** * @seeHttpServlet#doGet(HttpServletRequest request, HttpServletResponse * response) */ protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { // TODOAuto-generated method stub } /** * @seeHttpServlet#doPost(HttpServletRequest request, HttpServletResponse * response) */ protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { HttpSession session = request.getSession(); String email = request.getParameter("email"); String pwd = request.getParameter("pass"); try { Class.forName("com.mysql.jdbc.Driver"); Connection con = DriverManager.getConnection("jdbc:mysql://localhost:3306/logindb", "root", "password"); Statement st = con.createStatement(); ResultSet rs; rs = st.executeQuery("select fname, lname, email from userAccount where Email='" + email + "' and password='" + pwd + "'"); if (rs.next()) { session.setAttribute("email", email); session.setAttribute("Fullname", rs.getString(1) + " " + rs.getString(2)); response.sendRedirect("success.jsp"); } else { response.sendRedirect("fail.jsp"); } } catch (Exception ssd) { System.out.println(ssd.getMessage()); } } } </code></pre>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload