Question about ResultSetMetadata methods

[mDennis10]

If i am writing a program that needs to query a sql database for username and password, can i use resultsetmetadata class to find out if that username and password was locationed in the database and if so how.

[doWhile]

A simple select query should tell you if the username/password combination is within the database. See the API for ResultSetMetaData - it provides meta data associated with a query, you retrieve the results of a query through a ResultSet.

[mDennis10]

if i were to just use a simple select query what would be returned if the username and password was not found

[doWhile]

Did you try it? What happened?

[mDennis10]

what i did was to create two local variables name userName and password. Then i used the userName and password supplied has the criteria for my search. I then store the result of the search in the local username and password variables. then i do a comparision to to find out if the username in the database matched the entered

 public boolean log ()
	 {
	      String userName = "",password = "";
	      try {
	      Connection con = DriverManager.getConnection ("jdbc:mysql://localhost/database", "root","");
	      Statement state = con.createStatement ();
	      ResultSet rs = state.executeQuery("SELECT userName,password FROM userTable WHERE userName='" + this.userName + "'");
	      
	      while (rs.next())
	      {
	    	  userName = rs.getString("userName");
	    	  password = rs.getString("password");
	      }
	      catch (SQLException e)
	      {
	    	  System.out.println (e.getMessage());
	      }
	      
	      if (this.userName.equal(userName) && this.password.equals (password))
	    	  return true
	    			  
	    	  else return false;
	}

what is want to know is if i could have just done the search without creating the local variables and use the resultset metadata to find out if the username and password is in the database

[JosAH]

I'd do something like this: make the db return a single 1 if the username and password match; if they don't match the ResultSet is empty and you know enough; there is no need to transfer a correct password over the wire ...

select 1 
from userTable 
where username = ? and password = ?

kind regards,

Jos