Struts Action Form

jaisimha.iiitk · #1 (**permalink**) 05-08-08, 01:24 PM

Hey guys. I'm new to Struts and I hope u cud solve this prob. Cheers.

I developed a Registration.html file and I have an in the action servlet (Registeruser) and an action form called UserRegForm. Plz see whether the Action servlet and the action form need any changes or additions. If I hav to write a Registration class, wat would dat include?

Registration.html:

HTML Code:

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Contact Us</title>
<link href="style.css" rel="stylesheet" type="text/css" />
</head>

<body>
<br>
<h1><p>Registration Details</p></h1> 
<hr></hr>
<div id="body2"><form action="/reguser" method="post" >
	<label>FIRST NAME:</label>
	<input name="First_name" type="text" id="fname" value="" /><br>
	<label>LAST NAME:</label>
	<input name="Last_name" type="text" id="lname" value="" /><br>
	<label>D.O.B:</label>
	<input name="Dob" type="text" id="dob" value="" /><br>
	<label>ADDRESS:</label>
	<input name="Address" type="text" id="address" value="" /><br>
	<label>PHONE NO:</label>
	<input name="Phno" type="text" id="pno" value="" /><br>
	<label>MOBILE NO:</label>
	<input name="Mobile" type="text" id="mob" value="" /><br>
        <label>PASSWORD:</label>
	<input name="Password" type="text" id="pass" value="" /><br>
	<input name="" type="submit" class="botton" value="SUBMIT" />
</form>
</div>
</body>
</html>

Registeruser Action Servlet:

java Code:

package org.controller;
 
 
 
import javax.servlet.http.HttpServletRequest;
import javax.servlet.*;
import javax.servlet.GenericServlet;
import javax.servlet.ServletContext;
import javax.servlet.ServletConfig;
import javax.servlet.http.*;
import javax.servlet.http.HttpServletResponse;
import java.sql.*;
import java.io.*;
 
import org.apache.struts.action.Action;
import org.apache.struts.action.ActionForward;
import org.apache.struts.action.ActionMapping;
import org.apache.struts.action.ActionForm;
 
public class Registeruser extends Action {
 
   // private String Mobile;
    
    public ActionForward execute(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException{
                String upno,uname,uaddress,upwd,dob, mob;
        //String supno,suname,suaddress,supwd;
        //PrintWriter out=response.getWriter();
        //response.setContentType("text/html");
        //out.println("<html><head></head><title></title><body bgcolor=\"#FFCCFF\">");
        
        //out.println("<center><h1>YOUR REGISTRATION IS SUCCESSFULL<BR>PLEASE CHECK YOUR INFORMATION :</h1></center>");
        //out.println("<form name=\"javanewuser\" >");
        //out.println("<center><table width=200 height=200 border=3 bordercolor=\"white\">");
        
        try
        {
                   ServletContext ee=getServletConfig().getServletContext();
                        Connection con=(Connection)ee.getAttribute("connection");
            
            uname=request.getParameter("First_name");
            upno=request.getParameter("Last_name");
            uaddress=request.getParameter("Address");
            dob=request.getParameter("Dob");
            mob=request.getParameter("Mobile");
                        upwd=request.getParameter("Password");
                       
            String ssql="insert into userinfo values(?,?,?,?,?,?)";
            PreparedStatement pistmt=con.prepareStatement(ssql);
            pistmt.setString(1,uname);
            pistmt.setString(2,upno);
            pistmt.setString(3,uaddress);
            pistmt.setString(4,dob);
                        pistmt.setString(5,mob);
                        pistmt.setString(6,upwd);
                        
            pistmt.executeUpdate();
                        return mapping.findForward("success");
    } catch(Exception e)
        {
            //out.println(e);
                        return mapping.findForward("error");
        } 
    
    /** Creates a new instance of Registeruser */
    
    }
 
    }

Action Form :

java Code:

package com.myapp.struts;
import javax.servlet.http.HttpServletRequest;
import org.apache.struts.action.ActionForm;
import org.apache.struts.action.ActionMapping;
 
public class UserRegForm extends ActionForm {
    
 
    private String First_name = null;
public String getName() {
          return (First_name);
    }      
    public void setName(String First_name) {
          this.First_name = First_name;
    }      
     
}

Nico · #2 (**permalink**) 05-08-08, 03:37 PM

I'm not really sure where to move this, but I guess Java seems the most appropriate place...

UnrealEd · #3 (**permalink**) 05-09-08, 06:30 AM

Well, you definitely need to do some verification of the inputted data.
For instance, I could enter "abcdefg" in the phone number field, and it would still store it in the database.

Apart from that: your code is vurnarable for database injection; I can simply enter a query into one of the fields, telling to destroy everything in the current table, and it will perfectly work with your script.