package net.ihypo.db;

import java.sql.ResultSet;
import java.sql.SQLException;

import net.ihypo.user.User;

import com.mysql.jdbc.Statement;

public class UserDb {
	
	private boolean getUser(String email,String psw) throws ClassNotFoundException, SQLException{
		
		Statement statement = (Statement) new DbDriver().getConnection().createStatement();
		ResultSet set = statement.executeQuery("select user_pwd from users where user_email = " + email + ";");
		
		if(set.next()){
			String password = set.getString("user_pwd");
			set = statement.executeQuery("select PASSWORD(" + psw + ") pwd;");
			set.next();
			psw = set.getString("psw");
			if(psw == password){
				return true;
			}
		}
		return false;
	}
	
	public User judgeLogin(String email,String pwd) throws SQLException, ClassNotFoundException{
		if(getUser(email, pwd)){
			Statement statement = (Statement) new DbDriver().getConnection().createStatement();
			ResultSet set = statement.executeQuery("select user_id,user_name,user_email"
					+ " from users where user_email = " + email + ";");
			set.next();
			int id = set.getInt("user_id");
			User user = new User(id, set.getString("user_name"), set.getString("user_email"));
			
			return user; 
		}
		
		return null;
	}
}

@@ -425,32 +425,33 @@
 re user_email = 
+'
 %22 + email + %22;%22)
@@ -443,24 +443,25 @@
  + email + %22
+'
 ;%22);%0A%09%09%0A%09%09if
@@ -571,16 +571,17 @@
 ASSWORD(
+'
 %22 + psw 
@@ -583,16 +583,17 @@
  psw + %22
+'
 ) pwd;%22)
@@ -634,18 +634,18 @@
 tring(%22p
-s
 w
+d
 %22);%0A%09%09%09i
@@ -653,12 +653,16 @@
 (psw
- == 
+.equals(
 pass
@@ -666,16 +666,17 @@
 assword)
+)
 %7B%0A%09%09%09%09re
@@ -1043,16 +1043,17 @@
 email = 
+'
 %22 + emai
@@ -1057,16 +1057,17 @@
 mail + %22
+'
 ;%22);%0A%09%09%09

update userDB