0
ici est ma page jspJe l'ai utilisé les haricots jsp et java pour une application de musique store.but l'ensemble et obtenir les méthodes ne fonctionnent pas
<%@ page import="java.sql.Connection"%>
<%@ page import="java.sql.DriverManager"%>
<%@ page import="java.util.ArrayList"%>
<%@ page import="java.sql.ResultSet"%>
<%@ page import="Mybean.Bean"%>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Music Store</title>
</head>
<jsp:useBean id="bn" scope="page" class="Mybean.Bean" type="Bean"/>
<jsp:setProperty name="bn" property="searchbox" />
<body style="text-align:center" bgcolor="teal">
<h1>Welcome to Music Store</h1>
<hr align="center" size="3" style="background-color:silver" width="80%">
<br>
<form action="index.jsp" method="post">
<A HREF="Albums.jsp">All Albums</A>
<font face="Verdana" size="3" style="font-weight:bold">Search</font>
<select id="ddList" name="ddList">
<option id="op1" value="Album">Album</option>
<option id="op2" value="Song">Song</option>
<option id="op3" value="Artist">Artist</option>
</select>
<input type="text" name="searchBox" size="50" value="">
<input type="submit" value="Go"><br><br>
</form>
<div name="asshole"></div>
<div align="center" style="background-color:teal;">
<h3>Search Result</h3>
<table style="border:blue;" bgcolor="silver" border="3" cellpadding="0" cellspacing="0">
<%
if(request.getMethod().equalsIgnoreCase("post")){
//out.println("yeah am here");
try {
Connection cn = null;
Class.forName("com.mysql.jdbc.Driver");
String serverName = "localhost";
String mydatabase = "musicstore";
String url = "jdbc:mysql://" + serverName + "/" + mydatabase; // a JDBC url
String username = "root";
String password = "root";
String albumnme="",songnme="",artistnme="";
String searchType = request.getParameter("ddList");
//out.println("search type: "+searchType);
cn = DriverManager.getConnection(url, username, password);
try {
java.sql.Statement stmt = cn.createStatement();
java.sql.Statement stmt1 = cn.createStatement();
java.sql.Statement stmt2 = cn.createStatement();
ResultSet rs = null;
if(searchType.equals("Album")){
%>
<tr bgcolor="#662835"><td width="150">Song</td><td width="150">Artist</td></tr>
<%
rs = stmt.executeQuery("SELECT songsinfo.songtitle,artistinfo.artistName FROM albuminfo,songsinfo,artistinfo where albuminfo.albumtitle = '"+bn.getSearchbox()+"' AND songsinfo.albumID = albuminfo.albumID AND songsinfo.songid = artistinfo.songID");
while (rs.next()) {
if(!rs.getString(1).equalsIgnoreCase(songnme)){
%>
<tr>
<td><%out.println(rs.getString(1));%></td>
<td><%out.println(rs.getString(2));%>
<%
}
else if(!rs.getString(2).equalsIgnoreCase(artistnme)){
%>
,<%out.println(rs.getString(2));%>
<%
}
else{
%>
</td>
</tr>
<%
}
songnme = rs.getString(1);
artistnme = rs.getString(2);
}
}
else if(searchType.equals("Song")){//out.println("hey2");
%>
<tr bgcolor="#662835"><%--<td width="150">Song</td>--%><td width="150">Album</td><td width="150">Artist</td></tr>
<jsp:getProperty name="bn" property="searchbox" />
<%
rs = stmt.executeQuery("SELECT songsinfo.songid,artistinfo.artistName,albuminfo.albumtitle FROM songsinfo,artistinfo,albuminfo WHERE songsinfo.songtitle ='"+bn.getSearchbox()+"' AND songsinfo.songid =artistinfo.songId AND songsinfo.albumid = albuminfo.albumID;");
while (rs.next()) {
//artistnme = artistnme + rs.getString(2) + ",";
//albmnme = rs.getString(3);
if(!rs.getString(3).equalsIgnoreCase(albumnme)){
%>
<tr>
<%--<td><%out.println(rs.getString(1));%></td>--%>
<td><%out.println(rs.getString(3));%></td>
<td><%out.println(rs.getString(2));%>
<%
}
else if(!rs.getString(2).equalsIgnoreCase(artistnme)){
%>
,<%out.println(rs.getString(2));%>
<%
}
else{
%>
</td>
</tr>
<%
}
albumnme = rs.getString(3);
artistnme = rs.getString(2);
}
//out.println("album name ="+albmnme);
//out.println("song name ="+searchText);
//out.println("artist name ="+artistnme);
}
else if(searchType.equals("Artist")){//out.println("hey3");
%>
<tr bgcolor="#662835"><td width="150">Album</td><td width="150">Song</td></tr>
<%
rs = stmt.executeQuery("SELECT albuminfo.albumtitle,songsinfo.songtitle,artistinfo.artistName FROM albuminfo,songsinfo,artistinfo where artistinfo.artistName ='"+bn.getSearchbox()+"' AND songsinfo.songid = artistinfo.songId AND albuminfo.albumid = artistinfo.albumID");
while (rs.next()) {
//albmnme = rs.getString(1);
//songnme = songnme + rs.getString(2) +",";
//artistnme = artistnme + rs.getString(3) + ",";
if(!rs.getString(1).equalsIgnoreCase(albumnme)){
%>
<tr>
<td><%out.println(rs.getString(1));%></td>
<td><%out.println(rs.getString(2));%><%
}
else if(!rs.getString(2).equalsIgnoreCase(songnme)){
%>
<%out.println(rs.getString(2));%>
<%
}
else{
%>
</td>
</tr>
<%
}
albumnme = rs.getString(1);
songnme = rs.getString(2);
}
//out.println("album name ="+searchText);
//out.println("song name ="+songnme);
//out.println("artist name ="+artistnme);
}
//ResultSet rs = stmt.executeQuery("SELECT * FROM albuminfo where albumtitle='"+searchText+"'");
stmt.close();
} catch (Exception e) {
System.out.println("sorry no data found");
}
} catch (Exception e) {
out.println(e);
}
}
%>
</table>
</div>
</body>
</html>
Heres ma classe haricot
package Mybean;
public class Bean
{
private String searchbox;
public String getSearchbox() {
return searchbox;
}
public void setSearchbox(String searchbox) {
System.out.println("inside set");
this.searchbox = searchbox;
}
}
Informez-vous sur des sujets tels que «injection SQL» et «Cross-Site Scripting». Cela en vaut la peine lorsque vous créez des applications Web accessibles au public. –
Ce qui signifie que Roland Illing est que vous devez utiliser PreparedStatment au lieu d'utiliser la construction de la chaîne de requête à la main –
Le code est en effet terrible, mais un magasin de musique est une application de devoirs/selfpractice typique. Ces leçons de sécurité et de gestion des ressources appropriées (ce code va planter après quelques heures intensément) et la séparation du code propre (il manque de contrôleur, domaine et DAO classes) (espérons-le) viendra plus tard s'il suit un * décent * éducation ou livre. @Xavier: 'PreparedStatement' empêche uniquement les attaques par injection SQL, pas les attaques XSS. – BalusC