英文:
How to check if username exists in database or not without submitting the form using jsp?
问题
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Controller</title>
</head>
<body>
<div class="container">
<%
String Username = request.getParameter("Username");
session.setAttribute("theName", Username);
Class.forName("com.mysql.jdbc.Driver");
Connection con = DriverManager.getConnection("jdbc:mysql://localhost:3306/abc?autoReconnect=true&useSSL=false", "root", "");
try{
Statement st = con.createStatement();
ResultSet rs;
rs = st.executeQuery("select * from signupform where Username='" + Username + "'");
if(rs.next()){
String usermessage = "Username already exists";
request.getSession().setAttribute("usermessage", usermessage);
response.sendRedirect("Signupform.jsp");
} else {
PreparedStatement ps = con.prepareStatement("insert into signupform(Username) values(?)");
ps.setString(1, Username);
if(Username.isEmpty()) {
String message = "Please fill all the fields";
request.getSession().setAttribute("message", message);
response.sendRedirect("Signupform.jsp");
} else {
ps.executeUpdate();
response.sendRedirect("Welcome.jsp");
}
}
} catch (Exception e) {
out.println(e);
}
%>
</div>
</body>
</html>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Register</title>
<link Rel=stylesheet type="text/css" href="main.css">
</head>
<body>
<div class ="container">
<div>
<form action="controller1.jsp" method="POST">
Username <input type="text" name="Username" value="">
<br>
<input type="submit" value="Submit"/>
<input type="reset" value="Reset"/>
<br>
<p>${usermessage}</p>
<c:remove var="usermessage" scope="session"/>
</form>
</div>
</div>
</body>
</html>
英文:
I am trying to check if username exists in database or not without submitting the form. But I am not getting success.
Below is my code.
controller1.jsp
<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
pageEncoding="ISO-8859-1"%>
<%@ page import="java.io.*,java.util.*,java.sql.*"%>
<%@ page import="javax.servlet.http.*,javax.servlet.*"%>
<%@ page import="java.util.regex.*"%>
<%-- <%@ page import="java.net.URLEncoder" session="false" %> --%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Controller</title>
</head>
<body>
<div class="container">
<%
String Username = request.getParameter("Username");
session.setAttribute( "theName", Username );
Class.forName("com.mysql.jdbc.Driver");
Connection con = DriverManager.getConnection("jdbc:mysql://localhost:3306/abc?autoReconnect=true&useSSL=false", "root", "");
try{
Statement st = con.createStatement();
ResultSet rs;
rs = st.executeQuery("select * from signupform where Username='" + Username + "'");
if(rs.next()){
String usermessage = "Username already exists";
request.getSession().setAttribute("usermessage", usermessage);
response.sendRedirect("Signupform.jsp");
}
else{
PreparedStatement ps = con. prepareStatement("insert into signupform(Username) values(?)");
ps.setString(1, Username);
if(Username.isEmpty())
{
String message = "Please fill all the fields";
request.getSession().setAttribute("message", message);
/* response.sendRedirect("Signupform.jsp?message="+ URLEncoder.encode(message, "UTF-8")); */
response.sendRedirect("Signupform.jsp");
}
else{
ps.executeUpdate();
response.sendRedirect("Welcome.jsp");
}
}
}
catch (Exception e) {
out.println(e);
}
%>
</div>
</body>
</html>
The form used for providing input is shown in the code Signupform.jsp. It should immediately report in the same page whether the user exists or not when the user fill the respective field.
Signupform.jsp
<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
pageEncoding="ISO-8859-1"%>
<%@ taglib uri = "http://java.sun.com/jsp/jstl/core" prefix = "c" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Register</title>
<link Rel=stylesheet type="text/css" href="main.css">
</head>
<body>
<div class ="container">
<div>
<form action="controller1.jsp" method = "POST">
Username <input type = "text" name = "Username" value="">
<br>
<input type="submit" value="Submit"/>
<input type="reset" value="Reset"/>
<br>
<p>${usermessage}</p>
<c:remove var="usermessage" scope="session"/>
</form>
</div>
</div>
</body>
</html>
答案1
得分: 1
首先，这是一个巨大的安全漏洞。不能像这样进行数据库查询；请使用PreparedStatement。或者，填写用户名：
joe'; DROP TABLE signupform CASCADE; --
然后你的数据库将会消失。
你似乎知道如何使用preparedstatements（你在插入操作中使用了它）。你必须在所有地方都使用它，几乎所有的SQL都必须是一个单独的字符串常量。如果你曾经输入过类似 "SELECT ...." + ... 的内容，停止这样做。
你想要的事情不容易实现。这不是网页的工作方式。客户端是客户端，服务器是服务器，除非你明确地让它们联系在一起，它们不会互相交流。
客户端必须使用JavaScript（在客户端上运行的代码）在输入时向服务器发出请求，触发用户名字段的更改，这本身就很棘手（有很多种方法可以更改浏览器中的文本字段。例如，你可以右键点击并选择粘贴，因此注册键盘处理程序是无效的）。
相对较简单的解决方案：使用setInterval大约每200毫秒检查一次。如果自上次检查以来字段没有被修改，则不执行任何操作；如果正在进行ajax调用，则不进行检查。否则，向服务器发送一个ajax调用来询问，并操作DOM以反映这一点。
你将不得不学习JavaScript，这并不是你一小时内能够完成的事情。这实际上归结为：“我如何编写web应用程序”。这个问题有答案，但是Stack Overflow并不适合这种情况。这更适合于书籍和非常长的教程。
英文:
For starters, this is a gigantic security hole. You can't do DB queries like this; use PreparedStatement. Alternatively, fill in for username:
joe'; DROP TABLE signupform CASCADE; --
and your database will disappear.
You seem to know how preparedstatements work (you're using it for the insert). You have to use it everywhere, all your SQL pretty much has to be a single string constant. If you ever type "SELECT ...." +... stop. Don't do that.
What you want can't easily be done. That's not how the web works. The client is the client, the server is the server, they aren't in contact with each other unless you explicitly make it so.
The client would have to use javascript (code that runs on the client) to ask the server as-you-type, triggering off of the username field changing, which is itself tricky (there are a heck of a lot of ways to change a text field in a browser. For example, you can right click and select paste, so registering a keyboard handler is no good).
Easy-ish solution: Use setInterval to check every ±200 milliseconds or so. Don't do anything if the field hasn't been modified since the last time you checked, and don't check if an ajax call is in progress. Otherwise, send an ajax call to the server to ask, and manipulate the DOM to reflect this.
You're going to have to learn javascript, which.. is not exactly a thing you'll get done in an hour. This really boils down to: "How do I write webapps". That question has answers, but SO is not a good place for that. That's more a matter for books and very long tutorials.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论