How to use where clause with session value in servlet - mysql

Question

I have passed a value into servlet using a session.then assign the value to a variable call 'ms'. now i want to select data using that variable with 'where' clause. but it does not work.
protected void processRequest(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
response.setContentType("text/html;charset=UTF-8");
PrintWriter out = response.getWriter();
HttpSession ses=request.getSession(false);
String ms = ses.getAttribute("ma").toString();
try {
dbconn = new DatabaseConnection();
conn = dbconn.setConnection();
stmt = conn.createStatement();
query = "select * from person where Email ="+ms;
res = dbconn.getResult(query, conn);
while(res.next()){
lst.add(res.getString("Username"));
lst.add(res.getString("Title"));
lst.add(res.getString("Fname"));
lst.add(res.getString("Lname"));
}
res.close();
}catch(Exception e){
RequestDispatcher rd =request.getRequestDispatcher("myAccount.jsp");
rd.forward(request, response);
}finally{
request.setAttribute("EmpData", lst);
RequestDispatcher rd =request.getRequestDispatcher("myAccount.jsp");
rd.forward(request, response);
lst.clear();
out.close();
}

Answer 1

It's your query causing the exception.
Instead of
query = "select * from person where Email ="+ms;
You should quote the email parameter.
query = "select * from person where Email ='"+ms+"'";
But your code is vulnerable to SQL injection. It is better to use PreparedStatement for this.
By the way, it is also better to print the stack trace on catch clause, you could spot what exactly going wrong easily.