Thread: Shopping cart application

This is my payment web service code...but iam not able to identify the mistake.could you just help me with sample payment service code for shopping cart

/*
 * To change this template, choose Tools | Templates
 * and open the template in the editor.
 */
 
package payment;
 
 
import java.sql.*;
import javax.annotation.Resource;
import javax.jws.WebMethod;
import javax.jws.WebParam;
import javax.jws.WebService;
import javax.sql.DataSource;
 
/**
 *
 * @author Vijayalekshmy
 */
@WebService()
public class payment {
    @Resource(name = "data2")
    private DataSource data2;String userName=new String("");
    String passWord=new String("");
String name=new String("");
String str, p, q, r;
 
 
 
    /**
     * Web service operation
     */
 
    @WebMethod(operationName = "pay")
    public String pay(@WebParam(name = "CCNO")
    String CCNO, @WebParam(name = "CVV")
    String CVV, @WebParam(name = "Amount")
    float Amount) {
        //TODO write your implementation code here:
try {
            str="";
            p="";
q="";
r=".";
     Class.forName("com.mysql.jdbc.Driver");
            Connection con = DriverManager.getConnection("jdbc:mysql://localhost/test","root","ashwin");
 
            ResultSet rs=null, rs1;
            String sq = "select cno, cvv from payment";
  Statement s = con.createStatement();
  Statement s1 = con.createStatement();
  Statement st =  con.createStatement();
  s.executeQuery (sq);
   rs = s.getResultSet();
   while (rs.next()){
      /* str="Incorrect";
    userName=rs.getString("cno");
    passWord=rs.getString("cvv");
    if(userName.equals(userNam)&&passWord.equals(passwrd)){
        rs1=st.executeQuery("update payment set ctype='"+passwrd+"' where cno='"+userNam+"'");
 str="Thanks for Shopping!";
      }*/
       str+=rs.getString(1)+","+rs.getString(2)+",";
       p=rs.getString(1);
 
       q=rs.getString(2);
      if(CCNO.equals(rs.getString("ccno"))&&CVV.equals(rs.getString("cvv"))){
        System.out.print(""+p+CCNO);
        //rs1=st.executeQuery("update payment set ctype='"+passwrd+"' where cno='"+userNam+"'");
 
              String sq1 =" update payment set bal=bal-"+Amount+" where ccno='"+CCNO+"'";
               s1.executeUpdate(sq1);
                r="thanks ";
       }
       }
    rs.close ();
      s.close ();
      }catch(Exception e){
      System.out.println("Exception is ;"+e);
      }
 
    return r;
    }
 
}

We can't identify the mistake either. What does this code do? What do you expect it to do? Does it throw an error? Exhibit some strange behavior? Something else? Which part of this code is broken? Where is your SSCCE?