My program is not going inside the "if" part and it is always going in the "else" part

Question

I have done the connection with Oracle 10g Xe database through the following code.

Context ctx=new InitialContext();
DataSource ds=(DataSource)ctx.lookup("java:OracleDS");
Connection con=ds.getConnection(); 

String mob=request.getParameter("mob_no");
String pass=request.getParameter("pass");
Statement stmt=con.createStatement();

//checking login details
String sql="select * from user1 where mob_no='"+mob+"' and password='"+pass+"'";
ResultSet rs=stmt.executeQuery(sql);
String sql2="select * from postpaid where mob_no='"+mob+"'";
ResultSet rs2=stmt.executeQuery(sql2);

if(rs.isBeforeFirst())
{
    while(rs2.next())
    {  
        if(rs2.getInt(2)!=0)
        {
            out.println("You have total due of "+rs2.getInt(2));
            out.println("<a href=\"paybill.jsp\">Pay Bill</a>");
        }
        else {
            out.println("You have no dues!!!!!");
        }
    }
}
else
{
  out.println("Invalid login details.....<a href=\"#\">Back to home page</a>");
}

My program always shows the result "Invalid login Details"

Answer 1

The documentation for isBeforeFirst() says:

"Returns true if the cursor is before the first row; false if the cursor is at any other position or the result set contains no rows."

In this context, the false most likely means the latter; i.e. your result set is empty because no rows match the supplied user and password in the first query.

UPDATE

My answer is basically the same. The final else branch is taken because the first query matches no rows.

Why?

I could guess ... but instead, I suggest you print out the query SQL that you are executing to make sure that the statments are what they ought to be.

Another thing to note is that building queries like this:

  String sql="select * from user1 where mob_no='"+mob+"' and password='"+pass+"'";

is dangerous. Suppose someone sent a request with a mob_no argument whose value was something like this:

  "foo' ; drop table user1 ;"

You should use a PreparedStatement with SQL like this:

  String sql = "select * from user1 where mob_no = ? and password = ?";

and use PreparedStatement.setString(...) to add the parameter values.