Java login system using JSP and servlets

The system is pretty simple. Here is how the database looks:

table users:
    +----------+-------------+------+-----+---------+----------------+
    | Field    | Type        | Null | Key | Default | Extra          |
    +----------+-------------+------+-----+---------+----------------+
    | userid   | int(11)     | NO   | PRI | NULL    | auto_increment |
    | username | varchar(45) | NO   | UNI | NULL    |                |
    | password | varchar(32) | NO   |     | NULL    |                |
    | email    | varchar(75) | NO   | UNI | NULL    |                |
    +----------+-------------+------+-----+---------+----------------+
    table banbyip
    +--------+-------------+------+-----+---------+-------+
    | Field  | Type        | Null | Key | Default | Extra |
    +--------+-------------+------+-----+---------+-------+
    | ipAddr | varchar(45) | YES  |     | NULL    |       |
    +--------+-------------+------+-----+---------+-------+
    table banlist
    +--------+-------------+------+-----+---------+-------+
    | Field  | Type        | Null | Key | Default | Extra |
    +--------+-------------+------+-----+---------+-------+
    | ipAddr | varchar(45) | YES  |     | NULL    |       |
    +--------+-------------+------+-----+---------+-------+
    table loginattempts
    +----------+-------------+------+-----+---------+-------+
    | Field    | Type        | Null | Key | Default | Extra |
    +----------+-------------+------+-----+---------+-------+
    | ipaddr   | varchar(45) | NO   |     | NULL    |       |
    | username | varchar(45) | NO   |     | NULL    |       |
    | count    | int(11)     | NO   |     | NULL    |       |
    +----------+-------------+------+-----+---------+-------+

Here are the jsp, they are the pages shown to the user(View):
Home:

```
index.jsp


Login System

Some general stuff:

Your database code is scattered around a bit. You shouldn't be passing back ResultSets. You should execute the query, read the data into a Data Object and return the object (or a list of objects).

You should also use try-catch-finally OR try-with-resources to make sure database connections are cleaned up properly.

You shouldn't store the errors in a session. Use a List or String[] to hold error messages and then pass them from the Servlet to the View.

Keep your Database code contained. All your SQL statements in one class. All database operations in one class. You could have a separate class for each table you are interacting with that all use the utilities of the Database class.

You could also move you logic to 'Service Classes' and call that from the Servlet.

LoginService ls = new LoginService();

ls.validate(username, password, repeatPassword, email);

The validate method could return a list of errors (empty list means no errors).

StackExchange Code Review Q#118859, answer score: 3