Login Screen Problem

I'm using JSP for my dynamic web page and i am working on the login screen so that when an invalid user logs in the go directly to the error page but when a registered user logs in they go to the first page which is called irishshareprices.jsp. The problem is that no matter if it's a registered user or not it's automatically going to the indexerror.jsp page.

The following is the code i'm using:

<%-- Import required Java Classes --%>
<%@ page import="javax.servlet.*" %>
<%@ page import="javax.servlet.http.*" %>
<%@ page import="java.sql.*" %>

<%
String user = request.getParameter("username");
String pass = request.getParameter("password");

Connection con=null;
Statement stmt=null;
ResultSet rs=null;

/*if ((user == null)||(pass == null))
{
response.sendRedirect("indexerror.jsp");
}*/


String queryText="SELECT * FROM User WHERE UserID = '" + user + "' AND Password = '" + pass +"'";

try {
//initialize the JDBC-ODBC bridge driver
Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");

//open a connection to the database
String username = "";
String password = "";
con = DriverManager.getConnection("jdbcdbc:db",username,password);

//execute the query
stmt = con.createStatement();
rs = stmt.executeQuery(queryText);
} catch (Exception e) { }


if ((user == rs.getString("UserID")) && (pass == rs.getString("Password")))
{
response.sendRedirect("irishshareprices.jsp");
}
else
{
response.sendRedirect("indexerror.jsp");
}

%>

You are comparing strings, so == won't work unless these to string object references are the same. You need to use something like

if ((user.equals(rs.getString("UserID"))) && (pass.equals(rs.getString("Password"))))

Hi, thanks for your reply

I tried what you suggested but I got an internal server error. I put in the following line:
if ((user.equals("UserID")) && (pass.equals("Password")))

but it's still going to the indexerror page instead of the proper one. Is there anyway I can check if there is anything in rs so I can check if the database is picking anything up cause I can't understand why the code is automatically going to the error page.

I'd recommend then taking out the redirect code and putting in a variable printed to the screen. I don't do JSP, but I'm guessing it'll be something like

user id = "<%=rs.getString("UserID")%>"
typed user id = "<%=user%>"
Password = "<%=rs.getString("Password")%>"
typed Password = "<%=Password%>"

You should be able to tell the differences from this

And it's probably not gonna print out anything meaningful, as you need to call the .next() method on the resultset before printing the results cos until you call that it sits point before the first row in the result set (not at it)