response.sendRedirect() shows error - mysql

Question

I'm writing a simple jsp code for login which retrieves data from mysql. The code is showing error at response.sendRedirect("feedback.jsp");
<%#page import="java.sql.ResultSet"%>
<%#page import="java.sql.Statement"%>
<%#page import="java.sql.DriverManager"%>
<%#page import="java.sql.Connection"%>
<%
String user=request.getParameter("username");
String passwrd=request.getParameter("password");
try{
Class.forName("com.mysql.jdbc.Driver");
java.sql.Connection con = DriverManager.getConnection("jdbc:mysql://localhost:3306/feedback", "root", "");
Statement st=con.createStatement();
ResultSet rs=st.executeQuery("select username,password from users");
while(rs.next())
{
String username=rs.getString(1);
String password=rs.getString(2);
if(user.equals(username) && passwrd.equals(password))
{
response.sendRedirect("feedback.jsp");
}
else
{
out.println("Invalid Credentials");
}
}
}
catch(NumberFormatException e){
System.out.print(e);
e.printStackTrace();
}
%>
The connection to database is working as the else statement of "Invalid Credentials" is working if incorrect username and password combination is entered. The error i'm getting is "Cannot call sendRedirect() after the response has been committed"
Thanks.

Answer 1

if the URL is absolute http://www.google.com , it redirects to
http://www.google.com.
If the URL is not absolute , it redirects
relative to the current URL. If the URL starts with / it redirects
relative to the context root, Else it redirects to the current url
You should return after redirecting.
response.sendRedirect("http://www.google.com");
return;
It does not return automatically after calling sendRedirect().

Answer 2

First of all, Java code connecting to a database should be inside a servlet, and not inside a JSP. JSPs are view components. They should not use scriptlets AT ALL. Their only responsibility should be to generate HTML from attributes stored in the request by a controller, written in Java.
You get this exception because you try to redirect after sending data to the response already. Sending a redirect consists in setting a response header. And the headers are sent before the response body.
Also, your strategy for finding a user is extremely inefficient. You have the user name. So instead of getting all the users from the database and comparing them one by one with the username you have, you should add a where clause to your query:
select username, password from user where username = ?
Read the Java tutorial about prepared statements.
And finally, storing passwords in clear text in the database is a very bad practice. They should be hashed using a strong cryptographic hashing algorithm.

Answer 3

This is usually because you have sent response to the client, and you are changing or trying to send response after it is being sent to the user. Try removing any spaces or output before your redirect statement. In this case I would suggest remove all white-spaces before <% and then try executing your code.