JSP和Struts解决用户退出问题

　　Listing 1
//...
//initialize RequestDispatcher object; set forward to home page by default
RequestDispatcher rd = request.getRequestDispatcher("home.jsp");
//Prepare connection and statement
rs = stmt.executeQuery("select password from USER where userName = '" + userName + "'");
if (rs.next()) {
　//Query only returns 1 record in the result set; only 1
　password per userName which is also the primary key
　if (rs.getString("password").equals(password)) { //If valid password
　　session.setAttribute("User", userName); //Saves username string in the session object
　}
　else { //Password does not match, i.e., invalid user password
　　request.setAttribute("Error", "Invalid password.");
　　rd = request.getRequestDispatcher("login.jsp");
　}
} //No record in the result set, i.e., invalid username
else {
　request.setAttribute("Error", "Invalid user name.");
　rd = request.getRequestDispatcher("login.jsp");
}
}
//As a controller, loginAction.jsp finally either forwards to "login.jsp" or "home.jsp"
rd.forward(request, response);
//...

　　本文所附示例均以关系型数据库作为安全域，但本文所阐述的观点对任何类型的安全域都是适用的。