java - MYSQL connector saying it has connected even with the wrong username? -
i building database connection scanner security course @ university. have used drivermanager.getconnection(connectionurl, username, password) , seems work fine 1 exception cannot understand. if enter wrong username still returning connection??? test code pasted below. pointers appreciated. returns correct error if put wrong password in, if turn server off tells me. unknown reason not tell me if username wrong, if not checking!
public class dbconnector { connection connection = null; string dburl = "jdbc:mysql://localhost:3306"; string username; string password; public dbconnector() { // todo auto-generated constructor stub } public connection tryconnection(string username, string password){ try { class.forname("com.mysql.jdbc.driver").newinstance(); connection = drivermanager.getconnection(dburl, username, password); system.out.println("connected"); } catch (instantiationexception e) { system.out.println("no connection"); e.printstacktrace(); } catch (illegalaccessexception e) { system.out.println("connection refused"); e.printstacktrace(); } catch (classnotfoundexception e) { // todo auto-generated catch block e.printstacktrace(); } catch (sqlexception e) { system.out.println("sql ex"); // todo auto-generated catch block e.printstacktrace(); } return connection; } }
and here main class run method.
public class maintest { public static void main(string[] args) { dbconnector dbc = new dbconnector(); dbc.tryconnection("", ""); } }
maybe has running test on "localhost"?
thanks much!
i guess logging in anonymous user.
you can make local mysql server installation more secure (and hence force code above throw error) removing anonymous user this:
delete mysql.user user=''; flush privileges;
then try connecting no username , password.
Comments
Post a Comment