Click here to Skip to main content
15,904,153 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Parameter index out of range(1> number of parameters,which is 0)

What I have tried:

This is my code.The table users contains 3 rows.having username and password.It is giving me the error as:

Java
java.sql.SQLException: Parameter index out of range (1 > number of parameters, which is 0). 

String DRIVER = "com.mysql.jdbc.Driver"; 
Class.forName(DRIVER).newInstance(); 
String url="jdbc:mysql://localhost:3306/regis?user=root&password=fraze"; 
Connection Conn = DriverManager.getConnection(url); 


String strSQL = "select username,password from users where username like '%s'; 

PreparedStatement statement = Conn.prepareStatement(strSQL); 
statement.setString(1, user); 
statement.setString(2, pass); 
ResultSet Rs= statement.executeQuery(strSQL); 

if(myRs.next()){ 
out.println("Login Succesful! A record with the given user name and password exists"); 
} else { 
out.println("Login Failed. No records exists with the given user name and password"); 
} 
statement.close();


I want to verify with the database if the username and password entered are correct or not. Could any one suggest as what would be appropriate changes that are to be made.
Posted
Updated 9-Mar-20 20:24pm
v2
Comments
Pmourya 3-Feb-18 22:12pm    
I use clause "select* from user where name=?, password=?";then it gives an error com.mysql.jdbc.exception.jdbc4.mysqlSyntaxErrorException:you have an error in SQL syntax; check the manual that corresponds to your mysql server version for the right syntax to use near 'password='1234"at line 1. Pls help

1 solution

I explained what you need to do in your question yesterday, and even gave you the link to the documentation for the Select clause. So why are you now doing it another incorrect way? You need to do the following:
- Create a SELECT clause to find the record in the database for this userid, not userids that are like this one, but only this exact one.
- If the userid is found then create a salted hash of the password (link I gave you yesterday) and compare that with the one in the database.
- If both those tests succeed then continue, you have a valid login.

- If the userid is not found, or the passwords do not match then reject the login attempt. But do not tell the user that the password is wrong, that gives hackers too much information.
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900