java.sql.SQLException: ORA-00904: "PASS1": invalid identifier

private void submitActionPerformed(java.awt.event.ActionEvent evt) {
Connection c=Main.getCon();
char[] p=pass.getPassword();
String ps=new String(p);
try{
Statement st=c.createStatement();
ResultSet rs=st.executeQuery("select UNAME from users where PASS="+ps);
while(rs.next()){
String s=rs.getString(1);
if(s.equals(uname.getText())){
this.setVisible(false);
new welcome().setVisible(true);
}else{
JOptionPane j=new JOptionPane();
JOptionPane.showMessageDialog(j,"invalid password");
}
}
}catch(SQLException e){ e.printStackTrace(); }
}

Now.. Im using netbeans..Its a simple app with login panel having two fields "uname" and "pass", for username and password respectively. It simply connects to an oracle database table "users" with two columns "uname" and "pass". One of the entries in the table is "vishal", and "pass1".
here I declared getCon() in Main class which returns reference to Connection type object. Connection is successful. When I run the app I type "vishal" and "pass1" in the fields and hit submit. It shows following error,
java.sql.SQLException: ORA-00904: "PASS1": invalid identifier

what's the problem?

check this line

Quote:

---

ResultSet rs=st.executeQuery("select UNAME from users where PASS="+ps);

---

to

Quote:

---

ResultSet rs=st.executeQuery("select *from users where PASS='ps');

---

nope, that forms an unclosed string literal.

First select based on the username and the password. Don't select on one (and password? Honestly?) and then cycle through the results comparing against the other. Make the db do the work, since it'll be faster than anything you can write...it is its job after all.

Second use a PreparedStatement rather than concatenating your SQL string together, since I suspect this is all down to you missing out quotes.