Java - LoginServlet

Tänkte dela med mig av en, egenkomponerat, servlet som används vid användarverifikation, dvs. som loginservlet.

import java.io.*;
import java.util.*;

import javax.servlet.http.*;
import javax.servlet.*;

import java.sql.*;
import javax.sql.*;

public class LoginServlet extends HttpServlet {
  public void doPost (
	HttpServletRequest	request,
	HttpServletResponse	response
    ) throws ServletException, IOException
  {
  doGet(request,response);
  }

  public void doGet (
	HttpServletRequest	request,
	HttpServletResponse	response
    ) throws ServletException, IOException
  {
   HttpSession session = request.getSession(true);
   PrintWriter out = response.getWriter();

	try {
		String driverName="sun.jdbc.odbc.JdbcOdbcDriver"; 
		String dbUrl="jdbc:odbc:login";
		Class.forName(driverName);
		Connection db =DriverManager.getConnection(dbUrl,"","");

		if ((session.getAttribute("user") == null) || (!session.getAttribute("ip").equals(request.getRemoteAddr()))){

			PreparedStatement pStmt = db.prepareStatement("SELECT * FROM [login] WHERE [account] =? AND password=? AND [activated] = 1 ");
			pStmt.setString(1, request.getParameter("account"));
			pStmt.setString(2, request.getParameter("password"));
			ResultSet rs = pStmt.executeQuery();
			
			if(!rs.next()){
				System.out.println("Account is not valid.");
				request.setAttribute("msg", "Account is not valid.");
				RequestDispatcher rd = request.getRequestDispatcher("../login/index.jsp");
				rd.forward(request, response); 
			} 

			else do {
				int id = rs.getInt(1);
				String account = rs.getString(2);  
				session.setAttribute("user", new Integer(id));
				session.setAttribute("account", account);
				session.setAttribute("ip", request.getRemoteAddr());
				System.out.println("User " + session.getAttribute("user") +" has logged on.");

				request.setAttribute("msg", "User has logged on.");
				RequestDispatcher rd = request.getRequestDispatcher("../login/index.jsp");
				rd.forward(request, response); 
			} while(rs.next());
			rs.close();
			
		
		}
	
		else {
			System.out.println("User has already logged on.");
				request.setAttribute("msg", "User has already logged on.");
				RequestDispatcher rd = request.getRequestDispatcher("../login/index.jsp");
				rd.forward(request, response); 
		}

		db.close();
	}

	catch(Exception exp){
		System.out.println("Exception: "+ exp);
	}

   out.close();

  }	
}

På de sidor som sedan omfattas av själva loginproceduren adderas följande rader:

<%
if ((session.getAttribute("user") == null) || (!session.getAttribute("ip").equals(request.getRemoteAddr()))){
response.sendRedirect("index.jsp");
}
%>

Hoppas det duger hyfsat iaf.

Andreas