Thread: Using session atttributes and DAO class to delete mySql user records

Sorry if I wasn't clearly. My question is how can I correctly pass the user object so that the UserDB.delete methods functions correctly?

Line 27 is: user.setEmailAddress(emailAddress);

I don't set the session attribute. I GET the session attribute instead. The UserDB.delete method is as follows:

public static int delete(User user) {
        ConnectionPool pool = ConnectionPool.getInstance();
        Connection connection = pool.getConnection();
        PreparedStatement ps = null;
 
        String query = "DELETE FROM User "
                + "WHERE EmailAddress = ?";
        try {
            ps = connection.prepareStatement(query);
            ps.setString(1, user.getEmailAddress());
 
            return ps.executeUpdate();
        } catch (SQLException e) {
            e.printStackTrace();
            return 0;
        } finally {
            DBUtil.closePreparedStatement(ps);
            pool.freeConnection(connection);
        }
    }

Does the above make my question clearer? Thanks

Are you saying I have to set and get the session attribute in the same servlet? What if I want to use the session attribute that was set in a prior servlet? For example:

 
package user;
 
import java.io.*;
import javax.servlet.*;
import javax.servlet.http.*;
 
import business.User;
import data.UserDB;
import java.util.ArrayList;
 
public class DisplayUserServlet extends HttpServlet {
 
    protected void doGet(HttpServletRequest request,
            HttpServletResponse response)
            throws ServletException, IOException {
 
        String emailAddress = request.getParameter("emailAddress");
        User user = UserDB.selectUser(emailAddress);
 
        HttpSession session = request.getSession();
 
//        session.setAttribute("user", user);
 
        String url = "/user.jsp";
        RequestDispatcher dispatcher =
                getServletContext().getRequestDispatcher(url);
        dispatcher.forward(request, response);
    }
}

This is very useful to know but I still don't understand. What I'm creating here is actually an admin application. So the session attribute is set when the admin logs in and views a list of users which uses the DisplaytUserServlet mentioned above. If I want to use the session attribute from this display I can assume that the user session is still active since the UPDATE link (which calls the UserDeleteServlet action mentioned above) is on the list of users. Given this situation can I assume that the user session is still active from the list of users? Therefore, can I use the session attribute set by DisplayUserServlet?

Thanks in advance!

Workflow looks something like this:

UserDisplayServlet ---> user.jsp(lists a bunch of users) ---> 2 sets hyperlinks calling 2 separate actions for each user listed (update and delete)

---> CLICK DELETE ---> Calls DeleteUserServlet (which deletes based on the email address of the selected user in user.jsp

Is the above a clear workflow?

Don't know what you mean here. Are you saying because the UserDeleteServlet gets the correct info, you wish to use this as validation that the session is still active? Why not rely on getting the session attribute directly?

I'm not sure what you mean by 'getting the session attribute directly'. Do you mean get the attribute from DeleteUserServlet, instead of relying on getting it from DisplayUserServlet?

I'm asking if I HAVE to get the attribute from DeleteUserServlet to preserve the values stored in the session (since the email address value is used as a primary key to delete the selected user)?

I think what I'm not understanding is if I SET the session attribute in the UserDeleteServlet will it clear the primary key (email address) selected in the user list since I'm setting a new session? If the answer is that I can set the attribute in the DeleteUserServlet, will this preserve the email address value for the selected user? If I set the attribute in the DeleteUserServlet does this mean that I also have to GET the attribute in the same servlet?

Hope I'm making more sense. Thanks again

Correct I want to delete a particular user not the logged in user. The logged in user is the admin.

to delete a different user pass the email as a parameter to the delete servlet (as it looks like you have) and use this to delete

From the above do you mean that I don't even need to get or set the session attribute? Just pass the parameter then create a new user object and call the UserBD.delete?

The user logged on does have admin permission. This is what I'm trying:

package user;
 
import java.io.*;
import javax.servlet.*;
import javax.servlet.http.*;
 
import business.User;
import data.UserDB;
import org.apache.log4j.Logger;
 
public class DeleteUserServlet extends HttpServlet {
 
    private static Logger logger = Logger.getLogger("ch14userAdmin");
 
    protected void doGet(HttpServletRequest request,
            HttpServletResponse response)
            throws ServletException, IOException {
 
        HttpSession session = request.getSession();
 
        logger.debug("Delete get user object returns: " + session.getAttribute("User"));
 
        String emailAddress = request.getParameter("emailAddress");
        User user = new User();
               session.setAttribute("user", user);
 
 
        UserDB.delete(user);
 
 
        logger.debug("Delete method returns " + UserDB.delete(user));
 
 
        String url = "/displayUsers";
        RequestDispatcher dispatcher =
                getServletContext().getRequestDispatcher(url);
        dispatcher.forward(request, response);
    }
}

Here's what I figured out so far:

- The session attribute value for the list of users is called ('users"), which is set in the DisplayUsersServlet which returns an ArrayList of users (I tried using DisplayUsersServlet, it works and displays the list in the users.jsp)

- The session attribute value for the update part is called DisplayUserServlet(singular user instead of users). This is rendered by user.jsp, which displays a form for the selected user

This tells me that I should pass the users session attribute (from the list of users) in the DeleteUsersServlet. This is what I tried:

 
 
package user;
 
import java.io.*;
import javax.servlet.*;
import javax.servlet.http.*;
 
import business.User;
import data.UserDB;
import org.apache.log4j.Logger;
 
public class DeleteUserServlet extends HttpServlet {
 
    protected void doGet(HttpServletRequest request,
            HttpServletResponse response)
            throws ServletException, IOException {
 
        HttpSession session = request.getSession();
 
 
//       User user =  (User) session.getAttribute("users");  
 
        String emailAddress = request.getParameter("emailAddress");
 
        UserDB.delete(user);
 
 
         session.setAttribute("users", user);
        String url = "/displayUsers";
        RequestDispatcher dispatcher =
                getServletContext().getRequestDispatcher(url);
        dispatcher.forward(request, response);
    }
}

The problem is I can't seem to cast an ArrayList to a User type object and I get the following error:

java.lang.ClassCastException: java.util.ArrayList cannot be cast to business.User
user.DeleteUserServlet.doGet(DeleteUserServlet.jav a:22)
javax.servlet.http.HttpServlet.service(HttpServlet .java:621)
javax.servlet.http.HttpServlet.service(HttpServlet .java:728)

Am I right in assuming that I need to pass the "users" session attribute in the DeleteUsersServlet? Any advice about how to deal with the ClassCastException?
Thank you