using jsp to check username and password

Question

Hello i'm learning a bit JSP and i have a problem with the code below. I create one index.jsp file and try to run it with eclipse or directly with Tomcat 6.0. I always get a error for the line "if (name.equals("user") && password.equals("1234"))". The error is java.lang.NullPointerException. I would be glad for any advise.

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
          "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de">

<head>
  <title>Practice</title>
</head>

<body>

<h2>Practice</h2>
<h3>Please enter your name and the password.</h3>
<form method="post" action="">
  <table>
<tr><td style="text-align:center">Name</td>
<td><input type="text" name="name" size="80" /></td>
</tr>
<tr><td style="text-align:center">Password</td>
<td><input type="text" name="password" size="80" /></td>
</tr>
<tr><td><input type="submit" value="Send" /></td>
<td><input type="reset" value="Reset" /></td>
</tr>
</table>
</form>

<%-- Testing name and password. --%>
<% String name = request.getParameter("name");
   String password = request.getParameter("password");
   if (name.equals("user") && password.equals("1234"))
     {
%>
       <p>Your Input is correct!</p>
<%   }
   else if (!name.equals(""))
     {
%>
       <p>Please enter your name!</p>
<%   }

   else if (!password.equals(""))
     {
%>
       <p>Please enter your password!</p>
<%   }

   else if (!name.equals("") && !password.equals(""))
     {
%>
       <p>Please enter your name and your password!</p>

<%   }

   else
     {
%>
       <p>Your input is not correct!</p>
<%   }
%>

</body>


</html>

What is sent in the http request? Perhaps setting action parameter to the right page? It's not recommened to tell the user if the username or password is wrong. Just tell him his credentials are wrong — Mark Baijens, Nov 15 '10 at 20:23

score 4 · Accepted Answer · edited May 23 '17 at 12:11

This is the wrong approach.

The JSP scriptlet code (the code in <% %> things) will always be executed immediately whenever the page is been requested, regardless of if it's been requested by a normal GET request (link, bookmark, etc) or a POST form submit.

On the initial request which should display the empty form, the code get executed as well and in an attempt to grab the request parameters, all it gets is null. Since you cannot invoke any methods on null, you will get a NullPointerException.

The easiest workaround to let it execute only on a form submit is to check if the request method is POST.

<%
    if (request.getMethod().equalsIgnoreCase("POST")) {
        // The form is been submitted. Put your code here.
    }
%>

Normally, when the form is submitted, the input fields which are not filled in will end up as empty strings, not as null. However, to make the code more robust, it's recommended to check for null anyway.

The correct solution to prevent NullPointerException is to check if the reference is not null before attempting to access it.

    if (name != null && !name.equals("user")) {
        // ...
    }

Alternatively, you can also wrap the references since "user" is guaranteed not null.

    if (!"user".equals(name)) {
        // ...
    }

However, scriptlets (raw Java code inside JSP files) are a bad practice. The normal practice is to let the form submit to a Servlet. You can then just override the doPost() method and write code there. You can learn anything about servlets in the [servlets] tag info page here.

score 1 · Answer 2 · answered Nov 15 '10 at 20:02

This is not a direct answer to why your jsp is giving you null pointer exceptions, but one way you can avoid them in your code when doing string comparisons against string literals (which won't solve your situation in the long run is to do something like this:

if("1234".equals(password)){
...
}

This way if password is null you get a false instead of a NPE.

using jsp to check username and password

2 Answers2