java - 从登录参数创建用户对象

Question

我试图在用户登录后创建一个包含所有用户字段的用户对象，以便我可以从用户类中检索任何给定的属性。这是用户类。

public class User  {

private String username;
private String password;
private String f_name;
private String l_name;
private String email;
private String dob;
private int user_id;

public User(){}

public User(String username, String password)
{
    this.username = username;
    this.password = password;
}

public User(String username, String password, String f_name, String l_name, String email, String dob, int user_id)
{
    this.f_name = f_name;
    this.l_name = l_name;
    this.username = username;
    this.password = password;
    this.email = email;
    this.dob = dob;
    this.user_id = user_id;
}

我有所有字段的 getter 和 setter。所有用户字段也存储在 Oracle 数据库中。

在我的 Java Servlet 中，我有以下代码来创建用户对象并设置 session 属性:

HttpSession session = request.getSession();

String username = request.getParameter("username").toString();
String password = request.getParameter("password").toString();

User user1 = new User(username, password);

session.setAttribute("username", username);
session.setAttribute("password", password);

如何仅根据用户名和密码创建包含所有用户字段的用户对象？

Answer 1

你应该:

• 一个类，它包含使用 User 对象引用以及 username 和 password 字段进行登录的业务逻辑。
• 如果用户通过了身份验证和验证，那么它应该返回一个包含所有数据的新 User 对象引用:f_name, l_name, email... 和 username 除了password。 这应该是您应该保存为 session 属性的对象。
• 如果用户提供了错误的凭据，那么您应该显示一条错误消息。

基本代码示例:

public class YourServlet extends HttpServlet {
    @Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
        throws ServletException, IOException {
        String username = request.getParameter("username").toString();
        String password = request.getParameter("password").toString();
        User user = new User(username, password);
        UserBL userBL = new UserBL();
        user = userBL.validateUser(user);
        if (user != null) {
            HttpSession session = request.getSession();
            session.setAttribute("user", user);
        } else {
            request.setAttribute("errorMessage", "User is not valid.");
        }
        request.getRequestDispatcher("/login.jsp").forward(request, response);
    }
}

public class UserBL {
    String hashPassword(String password) {
        //method to hash the password for security purposes
        //for simplicity, just returning the same String
        return password;
    }

    public User validateUser(User user) {
        UserDAO userDao = new UserDAO();
        //password should not be stored in plainText
        //so let's hash it
        String password = hashPassword(user.getPassword());
        return userDao.getUserFromCredentials(user.getUsername(), password);
    }
}

public class UserDAO {
    public User getUserFromCredentials(String username, String password) {
        //probably a query
        Connection con = null;
        PreparedStatement pstmt = null;
        ResultSet rs = null;
        User user = null;
        try {
            con = ... //retrieve your database connection
            //pretty basic query example, yours should be more secure
            pstmt = con.prepareStatement("SELECT f_name, l_name, email, ... FROM users"
                + " WHERE username = ? AND password = ?");
            pstmt.setString(1, username);
            pstmt.setString(2, password);
            rs = pstmt.executeQuery();
            if (rs.next()) {
                user = new User(rs.getString("f_name"), rs.getString("l_name"),
                    rs.getString("email"), ...);
            }
        } catch (Exception e) {
            //handle the exception
            e.printStacktrace();
        } finally {
            //close the resources
            try {
                rs.close();
                pstmt.close();
                con.close();
            } catch (SQLException e) {
                //handle the exception
                e.printStacktrace();
            }
        }
        return user;
    }
}