0

I am writing code to reset the user password. But when I log in and try to change the password, the new password is updated in every record stored in the database, i.e the new password entered is updated as the new password for all the records. I tried to edit the update query, but I am getting an error in syntax, how do I fix it?

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>

</body>
</html>
<%@page import="java.sql.*"%>
<%@page import="java.io.*"%>
<%
    String OldPassword = request.getParameter("OldPassword");
    String Newpass = request.getParameter("newpassword");
    String conpass = request.getParameter("conpassword");


    Connection con = null;
    Statement st = null;
    String pass = "";
    int id = 0;
    try {
        Class.forName("com.mysql.jdbc.Driver");
        String url = "jdbc:mysql://localhost:3306/form";
        con = DriverManager.getConnection(url, "root", "");
        st = con.createStatement();
        ResultSet rs = st.executeQuery("select * from login where password= '"+ OldPassword + "'");
        if (rs.next()) {
            pass = rs.getString("password");
        }
        if(Newpass.equals(conpass))
        {
            if (pass.equals(OldPassword)) {
                st = con.createStatement();
                int i = st.executeUpdate("update login set password='"+ Newpass + "'");
                out.println("Password changed successfully");
                st.close();
                con.close();
            } else {
                out.println("Old Password doesn't match");
            }
/*}else{
out.println("new password and confirm new password is not matching");
}*/
        }
    } catch (Exception e) {
        out.println(e);
    }
%>
2
  • 1
    "update login set password='"+ Newpass + "'" ... > : - (
    – markspace
    Mar 25, 2018 at 16:57
  • You need a where clause in your SQL update statement. Also google "Little Bobby Tables" and "SQL injection".
    – karora
    Mar 25, 2018 at 21:31

2 Answers 2

1

You also need to add a where clause in the query which restricts the password update to only that user.

You can use the id of the user to update the password.

You can find user id as

if (rs.next()) {
    pass = rs.getString("password");
    id = rs.getString("id");
}

Then you update query will be:

st.executeUpdate("update login set password='" + Newpass + "' where id='" + id + "'");
1
  • And you should still use parameters in the SQL so that a person can't set their password to "whoops'; drop table users" - please google "SQL injection"!
    – karora
    Mar 25, 2018 at 21:34
1

Try to use PreparedStatement because it is fast and more secure Check this for further Information and try not to marge all the code in one line use preparedStatement.setString(value) this is also prevents you from attacks of SQL Injection and executes more effectively..;

int i = st.executeUpdate("update login set password= ?");
              st.setString(newPass);
                out.println("Password changed successfully");
                st.close();
                con.close();
            } else {
                out.println("Old Password doesn't match");
            }
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.