[RosyS]

private void jButton1ActionPerformed(java.awt.event.ActionEvent evt) {                                       
if(count<3)
   {  
       try
       {   
           conn = DbConnection.ConnectDB();
          ps=conn.prepareStatement("select * from LOGIN_TBL where USERNAME='"+value1+"' and PASSWORD='"+value2+"'");              	  
          ps.setString(1,jTextField1.getText());
          ps.setString(2,jPasswordField1.getText());
          ResultSet rs=ps.executeQuery();
       
          if(rs.next())
          { 
              uname=rs.getString("USERNAME");
              pass=rs.getString("PASSWORD");
          }
          if(value1.equals(uname) && value2.equals(pass))
          {
           String str = "Dear " + jTextField1.getText() + ".\nWelcome ";
           JOptionPane.showMessageDialog(null,str, "Welcome", JOptionPane.INFORMATION_MESSAGE );
           d.setVisible(true);
          }
          else if(value1.equals("") || value2.equals(""))
          {
              JOptionPane.showMessageDialog(null,"UserId OR Password cannot be empty!","Error",JOptionPane.ERROR_MESSAGE);             
              jTextField1.requestFocus();     
           }
          else if (!value1.equals(uname) || !value2.equals(pass))    
          {          
               JOptionPane.showMessageDialog(null,"Please enter correct UserId or Password!","Error",JOptionPane.ERROR_MESSAGE);
               jTextField1.setText("");
               jPasswordField1.setText("");
               jTextField1.requestFocus();
          }
         }
                         
        catch(Exception e)
        {    
          System.out.println(e);
         }
         count++;  
         
     }  

}   

this is my login form                                

public class DbConnection {
     static Connection conn=DbConnection.ConnectDB();
        static Statement st;
        static Statement rs;
    public static Connection ConnectDB(){ 
    try{
     Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
    conn = DriverManager.getConnection ("jdbc:odbc:INVENTORY_MNGT");
     JOptionPane.showMessageDialog(null, "Connected");
     return conn;     
    }catch(Exception e){
        JOptionPane.showMessageDialog(null, e);
        return null;
    } 
}
}

this is connection class
but when i run the login form, it the form opens but when i click on login button gives an null pointer exception.....just wanted to know what my error is

[macosxnerd101]

*Moved to Java*

A NullPointerException means you are invoking a method, referencing a variable or constant, etc., from a non-primitive variable that is null. Without the stack trace, we can't help you. Also, we do not support the NetBeans GUI Builder b/c it produces such horrible code. Write your code by hand and we will be happy to help.

[pbl]

If it is a PreparedStatement

          ps=conn.prepareStatement("select * from LOGIN_TBL where USERNAME=? and PASSWORD=?");                  
          ps.setString(1,jTextField1.getText());
          ps.setString(2,jPasswordField1.getText());

and if there is a rs.next() it means you find the record

         if(rs.next())
          { 
            // we have a match
              // uname=rs.getString("USERNAME");
              // pass=rs.getString("PASSWORD");
          }

[MATTtheSEAHAWK]

On another note, this looks like it's vulnerable to SQL injection. I'm not sure if it is or not, but I didn't notice any code to prevent it. Be careful if this is a public application, people could easily manipulate your DB.

[macosxnerd101]

One more reason then to use a PreparedStatement as pbl suggested, since they are immune to SQL Injection attacks.

[MATTtheSEAHAWK]

macosxnerd101, on 11 January 2012 - 08:36 PM, said:

One more reason then to use a PreparedStatement as pbl suggested, since they are immune to SQL Injection attacks.

Oh! Thanks for the tip!

[pbl]

MATTtheSEAHAWK, on 11 January 2012 - 08:34 PM, said:

On another note, this looks like it's vulnerable to SQL injection.

No, it is a PreparedStatement, badly used but still a PreparedStatement

[RosyS]

pbl, on 11 January 2012 - 06:57 PM, said:

MATTtheSEAHAWK, on 11 January 2012 - 08:34 PM, said:

On another note, this looks like it's vulnerable to SQL injection.

No, it is a PreparedStatement, badly used but still a PreparedStatement

pbl, on 11 January 2012 - 06:31 PM, said:

If it is a PreparedStatement

          ps=conn.prepareStatement("select * from LOGIN_TBL where USERNAME=? and PASSWORD=?");                  
          ps.setString(1,jTextField1.getText());
          ps.setString(2,jPasswordField1.getText());

and if there is a rs.next() it means you find the record

         if(rs.next())
          { 
            // we have a match
              // uname=rs.getString("USERNAME");
              // pass=rs.getString("PASSWORD");
          }

Thank you sooooooo much..my problem resolved....thank you once again