java - Authenticate users using servlet -

this question has answer here:

• authenticating username, password using filters in java (contacting database) 4 answers

i implemented simple servlet checks if user exists in db, , if can continue main site.

the servlet:

protected void doget(httpservletrequest request, httpservletresponse response) throws servletexception, ioexception {         try {             //obtain customerdb data source tomcat's context             context context = new initialcontext();             basicdatasource ds = (basicdatasource)context.lookup(testappconstants.db_datasource);             connection conn = ds.getconnection();              //checks if username , password exists in db             preparedstatement ps = conn.preparestatement(testappconstants.select_users_by_name_stmt);             ps.setstring(1,request.getparameter("username"));             resultset rs  = ps.executequery();              boolean ismatch = false;              if(rs.next())             {                  string = request.getparameter("password");                 string b = rs.getstring("password");                 if(a.equals(b))                 {                     response.sendredirect("success.html");                     ismatch = true;                 }             }              if(!ismatch)             {                 response.sendredirect("index.html");             }              //commit update             conn.commit();             //close statements             ps.close();             //close connection             conn.close();          } catch (sqlexception | namingexception e) {             getservletcontext().log("error while closing connection", e);             response.senderror(500);//internal server error         }          return;     } 

i using response.sendredirect() function in success page how can authenticate user , determine if have permission or not. not allow use jsp.

thanks.

if want keep simple.

ps=conn.preparestatement("select * table uname='?' , password='?'); ps.setstring(1,"uname"); ps.setstring(2,"password"); int i=0; resultset rs=ps.executequery(); while(rs.next){ i++; } if(i>0){ //record exist i.e. valid } else{ //no record i.e. invalid } 

please handle exceptions