Take the 2-minute tour ×

Hi i have developed one login form in android.here i have use validation here.here i have to fill anyone(username or password) means my app is successfully displayed login fail and does not move to other activity.but the both field is empty means it is displayed success but does not move to other activity.but i wish to need both field empty means the app is displayed login fail...please help me hoe can i develop this.

this is my webservice code:

public class XcartLogin {
public String authentication(String userName,String password){

 String retrievedUserName = "";
 String retrievedPassword = "";
 String status = "";

   Connection con = DriverManager.getConnection("jdbc:mysql://localhost:3306/xcart432-pro","root","");
     PreparedStatement statement =  con.prepareStatement("SELECT * FROM xcart_customers WHERE login = '"+userName+"'");
      ResultSet result = statement.executeQuery();

     retrievedUserName = result.getString("login");
    retrievedPassword = result.getString("password");

    status = "Success!";


      status = "Login fail!!!";

      catch(Exception e){
      return status;



this is validation for my android code:


                   //   ADD  to save  and  read next time
                       String strUserName = userName.getText().toString().trim();
                       String strPassword = userPassword.getText().toString().trim();

                       if (null == strUserName || strUserName.length() == 0)
                           //  showToast("Enter Your Name");
                         userName.setError( "username is required!" );
isUserValidated = false;
  if (null == strPassword || strPassword.length() == 0)
                               //      showToast("Enter Your Password");
isPasswordValidated = false;
                         userPassword.setError( "password is required!" );

please help me...if both field is empty means the success message is not displayed here.

share|improve this question
Just off the topic.. The above form of code is very much susceptible for SQL injection & you should never retreive the password back from DB instead pass it as paramater to SQL prepared statement –  Harish Dec 9 '13 at 19:02

3 Answers 3

up vote 2 down vote accepted

try using

   if(retrievedUserName.equals(userName)&&retrievedPassword.equals(password)&&!(retrievedUserName.equals("") && retrievedPassword.equals("")))

instead of

share|improve this answer
ya it is worked..thanks you. –  Krishna Veni Sep 10 '12 at 4:16
you are welcome happy coding –  G_S Sep 10 '12 at 4:17
and even as Sujay suggested change the prepared statement. your's is a wrong usage of a prepared statement –  G_S Sep 10 '12 at 4:29

Before the if(status.equals("Success!")) statement in your validation code, you should do this first to avoid querying the database if any of the text fields are empty in the first place:

boolean errorOccurred = false;
if (strUserName.equals("")) {
    userName.setError("Username is required!");
    errorOccurred = true;

if (strPassword.equals("")) {
    userName.setError("Password is required!");
    errorOccurred = true;

if (errorOccurred) {
    return; // avoids executing the part of your code which queries the db

Checking for whether the input fields' values are null is quite pointless since if they don't contain anything, it will only be an empty string, or "". Then, to simplify your webservice code...

if (result.next()) { // use if instead of while, because ideally, only ONE record should
                     // be returned and hence, no need to loop;

    // then, just get the corresponding password
    retrievedPassword = result.getString("password");

if (retrievedPassword.equals(password)) {
    status = "Success!";

Further suggestion: put "Success!" in a String constant and use that instead of the literal value. You have lesser chances of committing mistakes this way and makes editing your code easier.

share|improve this answer

First of all, the way you're using the PreparedStatement is incorrect. Here's how you should modify it:

PreparedStatement statement =  con.prepareStatement("SELECT * FROM xcart_customers WHERE login = ?");

You would then use the setString(int paramIndex, String value) to set the value and then call the executeQuery() method. Something like this:

statement.setString(1, userName);

ResultSet result = statement.executeQuery();

This is secure and the actual way to use a PreparedStatement in your code.

Now, to test for your requirement, you should do something like this:

if(userName.equals(retrievedUserName)&&password.equals(retrievedPassword)&&!("".equals(retrievedUserName) && "".equals(retrievedPassword)))

Notice that I am checking userName and password against retrievedUserName and retrievedPassword and not the other way round because there retrievedUserName or retrievedPassword may be null as per the Javadoc for getString(int).


If the value were to come as null, then you would be dealing with a NullPointerException, which I guess you might want to avoid. Also, for the very same reason, you might want to check the arguments for null value as before you even try to query the database.

share|improve this answer

Your Answer


