2.Loginservlet.java

/*引入包文件*/
import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
import java.sql.*;
import java.util.*;

public class Loginservlet extends HttpServlet
{
    public void doPost(HttpServletRequest req,HttpServletResponse resp)
    throws ServletException,java.io.IOException
    {
        String sDBDriver="oracle.jdbc.driver.OracleDriver";
        Connection conn=null;
        ResultSet rs=null;
        Statement stmt=null;
        PrintWriter out;
        String strUserName="",strPassword="",strPrompt="",strSQL="",strTemp="";
        boolean fAuthorized=false;
        int i=2;
        HttpSession session=req.getSession();
        out = resp.getWriter();
        try{
  Class.forName(sDBDriver);
        }catch(java.lang.ClassNotFoundException e){
  System.err.println("dbbean():  "+e.getMessage());
        }
        
        try{
  conn=DriverManager.getConnection
           ("jdbc:oracle:thin:@lmz:1521:labora","scott","tiger");
  stmt=conn.createStatement();
        }catch(SQLException e){}
  /**get parameter**/
  strUserName=req.getParameter("username");
  strPassword=req.getParameter("password");

  //instance session variable：
  session.putValue("login_name","");
  session.putValue("user_name","");

           //Authenticate()
       strSQL = "select login_name,user_pwd from sys_user where     
                    login_name='"+strUserName+"'";
  try{
      rs=stmt.executeQuery(strSQL);
        if(rs.next()){
fAuthorized=true;
                  rs.close();
               }else{
fAuthorized=false;
rs.close();
      }
               conn.close();
      stmt.close();
  }catch(SQLException e){
     out.println("数据库错误！"+e.getMessage()+"n");
     out.println(strUserName);
     System.err.println("executeQuery():  "+e.getMessage());
  }

       if(fAuthorized){
  strTemp=(String)session.getValue("login_name");
  if (strTemp.compareTo("super")!=0){
      strSQL = "insert into sys_log 
               (user_name,prg_id,optype,primary,value,computer,ip) values('"+
      strUserName+"','00000','登录成功','登录名','"+
      session.getValue("user_name")+"','"+req.getRemoteHost()+
      "','"+req.getRemoteAddr()+"')";

      try{
int iReturn=stmt.executeUpdate(strSQL);
      }catch(SQLException e){}
      }

      if (((String)session.getValue("login_name")).compareTo("super")
                                                                        ==0)
                  {
     //resp.sendRedirect("/jsp/xxx.html");
      }else{//登录失败！
           strPrompt="登录失败，请重新登录。";
strSQL = "insert into sys_log 
                  (user_name,prg_id,optype,primary,value,computer,ip) values('"
                       +strUserName+"','00000','登录失败','登录名','"+
(String)session.getValue("user_name")+"','"+
                  req.getRemoteHost()+"','"+req.getRemoteAddr()+"')";

try{stmt.executeUpdate(strSQL);}
    catch(SQLException e){}
    resp.sendRedirect("/login.jsp");
}
}