CVE-2015-10047: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in KYUUBl school-register. It has been classified as critical. This affects an unknown part of the file src/DBManager.java. The manipulation leads to sql injection. The patch is named 1cf7e01b878aee923f2b22cc2535c71a680e4c30. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218355.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-15T10:15Z
Repository: https://github.com/KYUUBl/school-register
Language: Java
Files changed: src/DBManager.java
Commit date: 2015-02-05 23:37:10 +0100
Commit message: fuck sql injection

Diff: diff --git a/src/DBManager.java b/src/DBManager.java
index f90c21b..b0b4949 100644
--- a/src/DBManager.java
+++ b/src/DBManager.java
@@ -1,13 +1,11 @@
 import utils.AccountType;
 import utils.Pair;
 
-import java.sql.Connection;
-import java.sql.DriverManager;
-import java.sql.ResultSet;
-import java.sql.Statement;
+import java.sql.*;
 import java.util.ArrayList;
+import java.util.regex.Pattern;
 
 public class DBManager {
         Connection c;
         Statement stmt;
 
@@ -39,12 +37,13 @@ public class DBManager {
                         }
 //                        System.out.println("success");
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return grades;
         }
 
         public ArrayList<String> getStudentAbsences(String studentID, String fromData, String toData) {
@@ -60,12 +59,13 @@ public class DBManager {
                         }
 //                        System.out.println("success");
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return absences;
         }
 
         public ArrayList<String> getStudentNotes(String studentID, String fromData, String toData) {
@@ -82,12 +82,13 @@ public class DBManager {
                         }
 //                        System.out.println("success");
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return notes;
         }
 
         public ArrayList<Pair<Integer,String> > getStudentSubjects(String studentID) {
@@ -103,12 +104,13 @@ public class DBManager {
                         }
 //                        System.out.println("success");
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return subjects;
         }
 
         public ArrayList<Pair<Integer,String> > getTeacherSubjects(int teacherID) {
@@ -126,12 +128,13 @@ public class DBManager {
                         }
 //                        System.out.println("success");
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return subjects;
         }
 
         public ArrayList<Pair<String,String> > getSubjectStudents(int subjectID) {
@@ -149,195 +152,294 @@ public class DBManager {
                         }
 //                        System.out.println("success");
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return students;
         }
 
-        public void addStudentGrade(int subjectID, String studentID, int gradeValue, int activityID, String topic) {
+        public boolean addStudentGrade(int subjectID, String studentID, int gradeValue, int activityID, String topic) {
                 try {
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("INSERT INTO oceny_uczniow(id_przedmiotu,id_ucznia,wartosc,id_aktywnosci,tematyka) values(" + subjectID + "," + studentID + "," + gradeValue + "," + activityID + ",'" + topic + "');");
+                        PreparedStatement ps = c.prepareStatement("INSERT INTO oceny_uczniow(id_przedmiotu,id_ucznia,wartosc,id_aktywnosci,tematyka) values(?,?,?,?,?);");
+                        ps.setInt(1,subjectID);
+                        ps.setString(2, studentID);
+                        ps.setInt(3,gradeValue);
+                        ps.setInt(4,activityID);
+                        ps.setString(5,topic);
+                        ps.executeUpdate();
+                        ps.close();
+                        //stmt = c.createStatement();
+                        //stmt.executeUpdate("INSERT INTO oceny_uczniow(id_przedmiotu,id_ucznia,wartosc,id_aktywnosci,tematyka) values(" + subjectID + "," + studentID + "," + gradeValue + "," + activityID + ",'" + topic + "');");
 //                        System.out.println("success");
-                        stmt.close();
+                        //stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void addStudentNote(String studentID, int teacherID, String note, boolean isPositive, String date) {
+        public boolean addStudentNote(String studentID, int teacherID, String note, boolean isPositive, String date) {
                 try {
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("INSERT INTO uwagi(id_ucznia,id_nauczyciela,opis,czy_pozytywna,data_wystawienia) values('" + studentID + "'," + teacherID + ",'" + note + "'," + isPositive + ",to_date('" + date + "', 'DD.MM.YYYY'));");
+                        PreparedStatement ps =c.prepareStatement("INSERT INTO uwagi(id_ucznia,id_nauczyciela,opis,czy_pozytywna,data_wystawienia) values(?,?,?,?,to_date(?, 'DD.MM.YYYY'));");
+                        ps.setString(1,studentID);
+                        ps.setInt(2, teacherID);
+                        ps.setString(3, note);
+                        ps.setBoolean(4, isPositive);
+                        ps.setString(5, date);
+                        ps.executeUpdate();
+                        ps.close();
+                        //stmt = c.createStatement();
+                        //stmt.executeUpdate("INSERT INTO uwagi(id_ucznia,id_nauczyciela,opis,czy_pozytywna,data_wystawienia) values('" + studentID + "'," + teacherID + ",'" + note + "'," + isPositive + ",to_date('" + date + "', 'DD.MM.YYYY'));");
 //                        System.out.println("success");
-                        stmt.close();
+                        //stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void addStudentAbsence(String studentID, int lessonID) {
+        public boolean addStudentAbsence(String studentID, int lessonID) {
                 try {
                         stmt = c.createStatement();
                         stmt.executeUpdate("INSERT INTO nieobecnosci(id_ucznia,id_lekcji) values('" + studentID + "'," + lessonID + ");");
 //                        System.out.println("success");
                         stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
         public int addCompletedLesson(String data, int teacherID, int lessonID, String topic) {
                 int i=-1;
                 try {
+                        PreparedStatement ps = c.prepareStatement("INSERT INTO przeprowadzone_lekcje(data,id_prowadzacego,id_lekcji,temat_zajec) values(to_date(?, 'DD.MM.YYYY'),?,?,?);");
+                        ps.setString(1,data);
+                        ps.setInt(2,teacherID);
+                        ps.setInt(3,lessonID);
+                        ps.setString(4,topic);
+                        ps.executeUpdate();
+                        ps.close();
                         stmt = c.createStatement();
-                        stmt.executeUpdate("INSERT INTO przeprowadzone_lekcje(data,id_prowadzacego,id_lekcji,temat_zajec) values(to_date('" + data + "', 'DD.MM.YYYY')," + teacherID + "," + lessonID + ",'" + topic + "');");
+                        //stmt.executeUpdate("INSERT INTO przeprowadzone_lekcje(data,id_prowadzacego,id_lekcji,temat_zajec) values(to_date('" + data + "', 'DD.MM.YYYY')," + teacherID + "," + lessonID + ",'" + topic + "');");
 //                        System.out.println("success");
                         ResultSet rs = stmt.executeQuery("select lastval();");
                         rs.next();
                         i=rs.getInt(1);
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return -1;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return i;
         }
 
-        public void addStudent(String name, String lastname, String pesel, int phoneNumber, int classID) {
+        public boolean addStudent(String name, String lastname, String pesel, int phoneNumber, int classID) {
                 try {
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("INSERT INTO uczniowie(imie,nazwisko,pesel,telefon_do_rodzica,id_klasy) values('" + name + "','" + lastname + "','" + pesel + "'," + phoneNumber + "," + classID + ");");
+                        PreparedStatement ps = c.prepareStatement("INSERT INTO uczniowie(imie,nazwisko,pesel,telefon_do_rodzica,id_klasy) values(?,?,?,?,?);");
+                        ps.setString(1,name);
+                        ps.setString(2,lastname);
+                        ps.setString(3,pesel);
+                        ps.setInt(4,phoneNumber);
+                        ps.setInt(5,classID);
+                        ps.executeUpdate();
+                        ps.close();
+                        //stmt = c.createStatement();
+                        //stmt.executeUpdate("INSERT INTO uczniowie(imie,nazwisko,pesel,telefon_do_rodzica,id_klasy) values('" + name + "','" + lastname + "','" + pesel + "'," + phoneNumber + "," + classID + ");");
 //                        System.out.println("success");
-                        stmt.close();
+                        //stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void addclass(String section, int startYear, int tutorID) {
+        public boolean addclass(String section, int startYear, int tutorID) {
                 try {
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("INSERT INTO klasy(oddzial,rok_rozpoczecia,id_wychowawcy) values('" + section + "'," + startYear + "," + tutorID + ");");
+                        PreparedStatement ps = c.prepareStatement("INSERT INTO klasy(oddzial,rok_rozpoczecia,id_wychowawcy) values(?,?,?);");
+                        ps.setString(1,section);
+                        ps.setInt(2,startYear);
+                        ps.setInt(3,tutorID);
+                        ps.executeUpdate();
+                        ps.close();
+//                        stmt = c.createStatement();
+//                        stmt.executeUpdate("INSERT INTO klasy(oddzial,rok_rozpoczecia,id_wychowawcy) values('" + section + "'," + startYear + "," + tutorID + ");");
 //                        System.out.println("success");
-                        stmt.close();
+//                        stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+//                        e.printStackTrace();
+//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void addTeacher(String name, String lastname) {
+        public boolean addTeacher(String name, String lastname) {
                 try {
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("INSERT INTO nauczyciele(imie,nazwisko) values('" + name + "','" + lastname + "');");
+                        PreparedStatement ps = c.prepareStatement("INSERT INTO nauczyciele(imie,nazwisko) values(?,?);");
+                        ps.setString(1,name);
+                        ps.setString(2,lastname);
+                        ps.executeUpdate();
+                        ps.close();
+//                        stmt = c.createStatement();
+//                        stmt.executeUpdate("INSERT INTO nauczyciele(imie,nazwisko) values('" + name + "','" + lastname + "');");
 //                        System.out.println("success");
-                        stmt.close();
+//                        stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void addSubject(String name, int classID, int teacherID) {
+        public boolean addSubject(String name, int classID, int teacherID) {
                 try {
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("INSERT INTO przedmioty(nazwa,id_klasy,id_prowadzacego) values('" + name + "'," + classID + "," + teacherID + ");");
+                        PreparedStatement ps = c.prepareStatement("INSERT INTO przedmioty(nazwa,id_klasy,id_prowadzacego) values(?,?,?);");
+                        ps.setString(1,name);
+                        ps.setInt(2,classID);
+                        ps.setInt(3,teacherID);
+                        ps.executeUpdate();
+                        ps.close();
+//                        stmt = c.createStatement();
+//                        stmt.executeUpdate("INSERT INTO przedmioty(nazwa,id_klasy,id_prowadzacego) values('" + name + "'," + classID + "," + teacherID + ");");
 //                        System.out.println("success");
-                        stmt.close();
+//                        stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void addScheduleLesson(int subjectID, int lessonNumber, int weekday) {
+        public boolean addScheduleLesson(int subjectID, int lessonNumber, int weekday) {
                 try {
                         stmt = c.createStatement();
                         stmt.executeUpdate("INSERT INTO plan_lekcji(id_przedmiotu,nr_lekcji,dzien_tygodnia) values(" + subjectID + "," + lessonNumber + "," + weekday + ");");
 //                        System.out.println("success");
                         stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void yearEnd() {
+        public boolean yearEnd() {
                 try {
                         stmt = c.createStatement();
                         stmt.executeUpdate("UPDATE przedmioty SET aktywny = FALSE;");
                         stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void deactivateStudent(String studentID) {
+        public boolean deactivateStudent(String studentID) {
                 try {
                         stmt = c.createStatement();
                         stmt.executeUpdate("UPDATE uczniowie SET aktywny = false where pesel='" + studentID + "';");
                         stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void addStudentUser(String login, String password, String pesel) {
+        public boolean addStudentUser(String login, String password, String pesel) {
                 try {
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("INSERT INTO uzytkownicy(login,haslo) values('" + login + "','" + password + "');");
-                        stmt.executeUpdate("UPDATE uczniowie SET id_uzytkownika = '" + login + "' where pesel='" + pesel + "';");
-                        stmt.close();
+                        PreparedStatement ps = c.prepareStatement("INSERT INTO uzytkownicy(login,haslo) values(?,?);");
+                        ps.setString(1,login);
+                        ps.setString(2,password);
+                        ps.executeUpdate();
+                        ps.close();
+                        ps = c.prepareStatement("UPDATE uczniowie SET id_uzytkownika = ? where pesel=?;");
+                        ps.setString(1,login);
+                        ps.setString(2,pesel);
+                        ps.executeUpdate();
+                        ps.close();
+//                        stmt = c.createStatement();
+//                        stmt.executeUpdate("INSERT INTO uzytkownicy(login,haslo) values('" + login + "','" + password + "');");
+//                        stmt.executeUpdate("UPDATE uczniowie SET id_uzytkownika = '" + login + "' where pesel='" + pesel + "';");
+//                        stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void addTeacherUser(String login, String password, int teacherID) {
+        public boolean addTeacherUser(String login, String password, int teacherID) {
                 try {
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("INSERT INTO uzytkownicy(login,haslo) values('" + login + "','" + password + "');");
-                        stmt.executeUpdate("UPDATE nauczyciele SET id_uzytkownika = '" + login + "' where id=" + teacherID + ";");
-                        stmt.close();
+                        PreparedStatement ps = c.prepareStatement("INSERT INTO uzytkownicy(login,haslo) values(?,?);");
+                        ps.setString(1,login);
+                        ps.setString(2,password);
+                        ps.executeUpdate();
+                        ps.close();
+                        ps = c.prepareStatement("UPDATE nauczyciele SET id_uzytkownika = ? where id=?;");
+                        ps.setString(1,login);
+                        ps.setInt(2, teacherID);
+                        ps.executeUpdate();
+                        ps.close();
+                        //stmt = c.createStatement();
+                        //stmt.executeUpdate("INSERT INTO uzytkownicy(login,haslo) values('" + login + "','" + password + "');");
+                        //stmt.executeUpdate("UPDATE nauczyciele SET id_uzytkownika = '" + login + "' where id=" + teacherID + ";");
+                        //stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
         public User signIn(String login, String password) {
                 //w parze pierwszy argument to string drugi boolean
                 //i true jesli to uczen, false jesli to nauczyciel
                 //null jesli login nie istnieje lub zle haslo
                 try {
-                        stmt = c.createStatement();
-                        ResultSet rs = stmt.executeQuery("SELECT * from uzytkownicy join uczniowie on login=id_uzytkownika where login='" + login + "';");
+                        PreparedStatement ps = c.prepareStatement("SELECT * from uzytkownicy join uczniowie on login=id_uzytkownika where login=?;");
+                        ps.setString(1,login);
+                        //stmt = c.createStatement();
+                        ResultSet rs = ps.executeQuery();
                         while (rs.next()) {
                                 String pesel = rs.getString("pesel");
                                 String pass= rs.getString("haslo");
                                 if (!password.equals(pass)) return null;
                                 return new User(pesel, AccountType.STUDENT,pass);
                         }
-                        rs = stmt.executeQuery("SELECT * from uzytkownicy join nauczyciele on login=id_uzytkownika where login='" + login + "';");
+                        ps= c.prepareStatement("SELECT * from uzytkownicy join nauczyciele on login=id_uzytkownika where login=?';");
+                        ps.setString(1,login);
+                        rs = ps.executeQuery();
                         while (rs.next()) {
                                 int id = rs.getInt("id");
                                 String pass= rs.getString("haslo");
                                 if (!password.equals(pass)) return null;
                                 return new User(Integer.toString(id), AccountType.TEACHER,pass);
                         }
+                        ps.close();
                         return null;
                 } catch (Exception e) {
                         e.printStackTrace();
                         System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
@@ -364,12 +466,13 @@ public class DBManager {
                                 rs.close();
                                 stmt.close();
                         }
 //                        System.out.println("success");
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return shedule;
         }
         public ArrayList<Pair<String,String> > getStudentsWithoutUser() {
                 ArrayList<Pair<String,String> > students = new ArrayList<Pair<String,String> >();
@@ -383,12 +486,13 @@ public class DBManager {
                         }
 //                        System.out.println("success");
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return students;
         }
         public ArrayList<Pair<Integer,String> > getTeachersWithoutUser() {
                 ArrayList<Pair<Integer,String> > teachers = new ArrayList<Pair<Integer,String> >();
@@ -402,43 +506,60 @@ public class DBManager {
                         }
 //                        System.out.println("success");
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+//                        e.printStackTrace();
+//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return teachers;
         }
-        public void changeStudentPassword(String pesel,String password){
+        public boolean changeStudentPassword(String pesel,String password){
                 try {
-                        stmt = c.createStatement();
-                        ResultSet rs = stmt.executeQuery("select id_uzytkownika from uzytkownicy uz join uczniowie on id_uzytkownika=uz.login where pesel='" + pesel + "';");
+                        PreparedStatement ps = c.prepareStatement("select id_uzytkownika from uzytkownicy uz join uczniowie on id_uzytkownika=uz.login where pesel=?;");
+                        ps.setString(1,pesel);
+                        //stmt = c.createStatement();
+                        ResultSet rs = ps.executeQuery();
                         rs.next();
                         String userID = rs.getString("id_uzytkownika");
-                        stmt.close();
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("UPDATE uzytkownicy SET haslo = '"+password+"' where login='"+userID+"';");
-                        stmt.close();
+                        //stmt.close();
+                        //stmt = c.createStatement();
+                        ps= c.prepareStatement("UPDATE uzytkownicy SET haslo = ? where login=?;");
+                        ps.setString(1,password);
+                        ps.setString(2,userID);
+                        ps.executeUpdate();
+                        //stmt.executeUpdate("UPDATE uzytkownicy SET haslo = '"+password+"' where login='"+userID+"';");
+                        ps.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
-        public void changeTeacherPassword(int id,String password){
+        public boolean changeTeacherPassword(int id,String password){
                 try {
-                        stmt = c.createStatement();
-                        ResultSet rs = stmt.executeQuery("select id_uzytkownika from uzytkownicy uz join nauczyciele on id_uzytkownika=uz.login where id=" + id + ";");
+                        //stmt = c.createStatement();
+                        PreparedStatement ps = c.prepareStatement("select id_uzytkownika from uzytkownicy uz join nauczyciele on id_uzytkownika=uz.login where id=?;");
+                        ps.setInt(1,id);
+
+                        ResultSet rs = ps.executeQuery();
                         rs.next();
                         String userID = rs.getString("id_uzytkownika");
-                        stmt.close();
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("UPDATE uzytkownicy SET haslo = '"+password+"' where login = '"+userID+"';");
-                        stmt.close();
+                        //stmt.close();
+                        //stmt = c.createStatement();
+                        ps=c.prepareStatement("UPDATE uzytkownicy SET haslo = '"+password+"' where login = '"+userID+"';");
+                        ps.setString(1,password);
+                        ps.setString(2,userID);
+                        ps.executeUpdate();
+                        ps.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+//                        e.printStackTrace();
+//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
         public ArrayList<Pair<Integer,String> > getActivities(){
                 ArrayList<Pair<Integer,String> > activities = new ArrayList<Pair<Integer,String> >();
@@ -452,12 +573,13 @@ public class DBManager {
                         }
 //                        System.out.println("success");
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+//                        e.printStackTrace();
+//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return activities;
         }
 
         public ArrayList<Pair<Integer,String> > getLessonsByDate(String data){
@@ -474,12 +596,13 @@ public class DBManager {
                         }
 //                        System.out.println("success");
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return lessons;
         }
 
         public ArrayList<Pair<String,String> > getStudentsByLesson(int lessonID){
@@ -494,12 +617,13 @@ public class DBManager {
                         }
 //                        System.out.println("success");
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return students;
         }
 
         public ArrayList<Pair<Integer,String> > getAllClasses(){
@@ -510,12 +634,13 @@ public class DBManager {
                         while(rs.next()){
                                 classes.add(new Pair<Integer, String>(rs.getInt("id"),rs.getString("oddzial")+" "+rs.getString("rok_rozpoczecia")));
                         }
                         stmt.close();
                 }catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+//                        e.printStackTrace();
+//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return classes;
         }
         public ArrayList<Pair<String,String> > getAllStudents() {
                 ArrayList<Pair<String,String> > students = new ArrayList<Pair<String,String> >();
@@ -529,12 +654,13 @@ public class DBManager {
                         }
 //                        System.out.println("success");
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return students;
         }
         public ArrayList<Pair<String,String> > getAllStudentsByAdmin() {
                 ArrayList<Pair<String,String> > students = new ArrayList<Pair<String,String> >();
@@ -548,12 +674,13 @@ public class DBManager {
                         }
 //                        System.out.println("success");
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return students;
         }
 
         public ArrayList<Pair<Integer,String> > getTeachersWithoutClass() {
@@ -568,12 +695,13 @@ public class DBManager {
                         }
 //                        System.out.println("success");
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return teachers;
         }
 
         public ArrayList<Pair<Integer, String>> getAllTeachers() {
@@ -588,12 +716,13 @@ public class DBManager {
                         }
 //                        System.out.println("success");
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+//                        e.printStackTrace();
+//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return teachers;
         }
         public ArrayList<ArrayList<String> > getTeacherSchedule(int id){
                 ArrayList<ArrayList<String> > shedule = new ArrayList<ArrayList<String>>();
@@ -615,17 +744,17 @@ public class DBManager {
                                 rs.close();
                                 stmt.close();
                         }
 //                        System.out.println("success");
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+//                        e.printStackTrace();
+//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return shedule;
         }
 
-
         public static void main(String args[])
         {
                 DBManager dbManager = new DBManager();
                 //String a = "to ja a to nie ja";
                 //String b = "kurwa mac";
@@ -633,11 +762,10 @@ public class DBManager {
                 //System.out.printf("%-20s %s",a,b+"\n");
                 //System.out.printf("%-20s %s", b, c+"\n");
                 //System.out.printf("%-20s %s",c,a+"\n");
                 //dbManager.changeStudentPassword("95091673574","kamil");
                // dbManager.getTeachersWithoutClass();
-
-
-                ArrayList<Pair<Integer,String> > sub = dbManager.getStudentSubjects("95091673574");
-                for(int i=0;i<sub.size();i++) System.out.println(sub.get(i).getX()+" "+sub.get(i).getY());
+                //System.out.println(Pattern.matches(".*[;].*","adadada;asasas"));
+                //ArrayList<Pair<Integer,String> > sub = dbManager.getStudentSubjects("95091673574");
+                //for(int i=0;i<sub.size();i++) System.out.println(sub.get(i).getX()+" "+sub.get(i).getY());
         }
 }

Vulnerable code: import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.Statement;
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addStudentGrade(int subjectID, String studentID, int gradeValue, int activityID, String topic) {
                        stmt = c.createStatement();
                        stmt.executeUpdate("INSERT INTO oceny_uczniow(id_przedmiotu,id_ucznia,wartosc,id_aktywnosci,tematyka) values(" + subjectID + "," + studentID + "," + gradeValue + "," + activityID + ",'" + topic + "');");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addStudentNote(String studentID, int teacherID, String note, boolean isPositive, String date) {
                        stmt = c.createStatement();
                        stmt.executeUpdate("INSERT INTO uwagi(id_ucznia,id_nauczyciela,opis,czy_pozytywna,data_wystawienia) values('" + studentID + "'," + teacherID + ",'" + note + "'," + isPositive + ",to_date('" + date + "', 'DD.MM.YYYY'));");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addStudentAbsence(String studentID, int lessonID) {
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        stmt.executeUpdate("INSERT INTO przeprowadzone_lekcje(data,id_prowadzacego,id_lekcji,temat_zajec) values(to_date('" + data + "', 'DD.MM.YYYY')," + teacherID + "," + lessonID + ",'" + topic + "');");
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addStudent(String name, String lastname, String pesel, int phoneNumber, int classID) {
                        stmt = c.createStatement();
                        stmt.executeUpdate("INSERT INTO uczniowie(imie,nazwisko,pesel,telefon_do_rodzica,id_klasy) values('" + name + "','" + lastname + "','" + pesel + "'," + phoneNumber + "," + classID + ");");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addclass(String section, int startYear, int tutorID) {
                        stmt = c.createStatement();
                        stmt.executeUpdate("INSERT INTO klasy(oddzial,rok_rozpoczecia,id_wychowawcy) values('" + section + "'," + startYear + "," + tutorID + ");");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addTeacher(String name, String lastname) {
                        stmt = c.createStatement();
                        stmt.executeUpdate("INSERT INTO nauczyciele(imie,nazwisko) values('" + name + "','" + lastname + "');");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addSubject(String name, int classID, int teacherID) {
                        stmt = c.createStatement();
                        stmt.executeUpdate("INSERT INTO przedmioty(nazwa,id_klasy,id_prowadzacego) values('" + name + "'," + classID + "," + teacherID + ");");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addScheduleLesson(int subjectID, int lessonNumber, int weekday) {
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void yearEnd() {
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void deactivateStudent(String studentID) {
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addStudentUser(String login, String password, String pesel) {
                        stmt = c.createStatement();
                        stmt.executeUpdate("INSERT INTO uzytkownicy(login,haslo) values('" + login + "','" + password + "');");
                        stmt.executeUpdate("UPDATE uczniowie SET id_uzytkownika = '" + login + "' where pesel='" + pesel + "';");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addTeacherUser(String login, String password, int teacherID) {
                        stmt = c.createStatement();
                        stmt.executeUpdate("INSERT INTO uzytkownicy(login,haslo) values('" + login + "','" + password + "');");
                        stmt.executeUpdate("UPDATE nauczyciele SET id_uzytkownika = '" + login + "' where id=" + teacherID + ";");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        stmt = c.createStatement();
                        ResultSet rs = stmt.executeQuery("SELECT * from uzytkownicy join uczniowie on login=id_uzytkownika where login='" + login + "';");
                        rs = stmt.executeQuery("SELECT * from uzytkownicy join nauczyciele on login=id_uzytkownika where login='" + login + "';");
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void changeStudentPassword(String pesel,String password){
                        stmt = c.createStatement();
                        ResultSet rs = stmt.executeQuery("select id_uzytkownika from uzytkownicy uz join uczniowie on id_uzytkownika=uz.login where pesel='" + pesel + "';");
                        stmt.close();
                        stmt = c.createStatement();
                        stmt.executeUpdate("UPDATE uzytkownicy SET haslo = '"+password+"' where login='"+userID+"';");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void changeTeacherPassword(int id,String password){
                        stmt = c.createStatement();
                        ResultSet rs = stmt.executeQuery("select id_uzytkownika from uzytkownicy uz join nauczyciele on id_uzytkownika=uz.login where id=" + id + ";");
                        stmt.close();
                        stmt = c.createStatement();
                        stmt.executeUpdate("UPDATE uzytkownicy SET haslo = '"+password+"' where login = '"+userID+"';");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());



                ArrayList<Pair<Integer,String> > sub = dbManager.getStudentSubjects("95091673574");
                for(int i=0;i<sub.size();i++) System.out.println(sub.get(i).getX()+" "+sub.get(i).getY());
Fixed code: import java.sql.*;
import java.util.regex.Pattern;
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addStudentGrade(int subjectID, String studentID, int gradeValue, int activityID, String topic) {
                        PreparedStatement ps = c.prepareStatement("INSERT INTO oceny_uczniow(id_przedmiotu,id_ucznia,wartosc,id_aktywnosci,tematyka) values(?,?,?,?,?);");
                        ps.setInt(1,subjectID);
                        ps.setString(2, studentID);
                        ps.setInt(3,gradeValue);
                        ps.setInt(4,activityID);
                        ps.setString(5,topic);
                        ps.executeUpdate();
                        ps.close();
                        //stmt = c.createStatement();
                        //stmt.executeUpdate("INSERT INTO oceny_uczniow(id_przedmiotu,id_ucznia,wartosc,id_aktywnosci,tematyka) values(" + subjectID + "," + studentID + "," + gradeValue + "," + activityID + ",'" + topic + "');");
                        //stmt.close();
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addStudentNote(String studentID, int teacherID, String note, boolean isPositive, String date) {
                        PreparedStatement ps =c.prepareStatement("INSERT INTO uwagi(id_ucznia,id_nauczyciela,opis,czy_pozytywna,data_wystawienia) values(?,?,?,?,to_date(?, 'DD.MM.YYYY'));");
                        ps.setString(1,studentID);
                        ps.setInt(2, teacherID);
                        ps.setString(3, note);
                        ps.setBoolean(4, isPositive);
                        ps.setString(5, date);
                        ps.executeUpdate();
                        ps.close();
                        //stmt = c.createStatement();
                        //stmt.executeUpdate("INSERT INTO uwagi(id_ucznia,id_nauczyciela,opis,czy_pozytywna,data_wystawienia) values('" + studentID + "'," + teacherID + ",'" + note + "'," + isPositive + ",to_date('" + date + "', 'DD.MM.YYYY'));");
                        //stmt.close();
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addStudentAbsence(String studentID, int lessonID) {
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        PreparedStatement ps = c.prepareStatement("INSERT INTO przeprowadzone_lekcje(data,id_prowadzacego,id_lekcji,temat_zajec) values(to_date(?, 'DD.MM.YYYY'),?,?,?);");
                        ps.setString(1,data);
                        ps.setInt(2,teacherID);
                        ps.setInt(3,lessonID);
                        ps.setString(4,topic);
                        ps.executeUpdate();
                        ps.close();
                        //stmt.executeUpdate("INSERT INTO przeprowadzone_lekcje(data,id_prowadzacego,id_lekcji,temat_zajec) values(to_date('" + data + "', 'DD.MM.YYYY')," + teacherID + "," + lessonID + ",'" + topic + "');");
                        return -1;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addStudent(String name, String lastname, String pesel, int phoneNumber, int classID) {
                        PreparedStatement ps = c.prepareStatement("INSERT INTO uczniowie(imie,nazwisko,pesel,telefon_do_rodzica,id_klasy) values(?,?,?,?,?);");
                        ps.setString(1,name);
                        ps.setString(2,lastname);
                        ps.setString(3,pesel);
                        ps.setInt(4,phoneNumber);
                        ps.setInt(5,classID);
                        ps.executeUpdate();
                        ps.close();
                        //stmt = c.createStatement();
                        //stmt.executeUpdate("INSERT INTO uczniowie(imie,nazwisko,pesel,telefon_do_rodzica,id_klasy) values('" + name + "','" + lastname + "','" + pesel + "'," + phoneNumber + "," + classID + ");");
                        //stmt.close();
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addclass(String section, int startYear, int tutorID) {
                        PreparedStatement ps = c.prepareStatement("INSERT INTO klasy(oddzial,rok_rozpoczecia,id_wychowawcy) values(?,?,?);");
                        ps.setString(1,section);
                        ps.setInt(2,startYear);
                        ps.setInt(3,tutorID);
                        ps.executeUpdate();
                        ps.close();
//                        stmt = c.createStatement();
//                        stmt.executeUpdate("INSERT INTO klasy(oddzial,rok_rozpoczecia,id_wychowawcy) values('" + section + "'," + startYear + "," + tutorID + ");");
//                        stmt.close();
                        return true;
                        return false;
//                        e.printStackTrace();
//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addTeacher(String name, String lastname) {
                        PreparedStatement ps = c.prepareStatement("INSERT INTO nauczyciele(imie,nazwisko) values(?,?);");
                        ps.setString(1,name);
                        ps.setString(2,lastname);
                        ps.executeUpdate();
                        ps.close();
//                        stmt = c.createStatement();
//                        stmt.executeUpdate("INSERT INTO nauczyciele(imie,nazwisko) values('" + name + "','" + lastname + "');");
//                        stmt.close();
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addSubject(String name, int classID, int teacherID) {
                        PreparedStatement ps = c.prepareStatement("INSERT INTO przedmioty(nazwa,id_klasy,id_prowadzacego) values(?,?,?);");
                        ps.setString(1,name);
                        ps.setInt(2,classID);
                        ps.setInt(3,teacherID);
                        ps.executeUpdate();
                        ps.close();
//                        stmt = c.createStatement();
//                        stmt.executeUpdate("INSERT INTO przedmioty(nazwa,id_klasy,id_prowadzacego) values('" + name + "'," + classID + "," + teacherID + ");");
//                        stmt.close();
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addScheduleLesson(int subjectID, int lessonNumber, int weekday) {
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean yearEnd() {
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean deactivateStudent(String studentID) {
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addStudentUser(String login, String password, String pesel) {
                        PreparedStatement ps = c.prepareStatement("INSERT INTO uzytkownicy(login,haslo) values(?,?);");
                        ps.setString(1,login);
                        ps.setString(2,password);
                        ps.executeUpdate();
                        ps.close();
                        ps = c.prepareStatement("UPDATE uczniowie SET id_uzytkownika = ? where pesel=?;");
                        ps.setString(1,login);
                        ps.setString(2,pesel);
                        ps.executeUpdate();
                        ps.close();
//                        stmt = c.createStatement();
//                        stmt.executeUpdate("INSERT INTO uzytkownicy(login,haslo) values('" + login + "','" + password + "');");
//                        stmt.executeUpdate("UPDATE uczniowie SET id_uzytkownika = '" + login + "' where pesel='" + pesel + "';");
//                        stmt.close();
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addTeacherUser(String login, String password, int teacherID) {
                        PreparedStatement ps = c.prepareStatement("INSERT INTO uzytkownicy(login,haslo) values(?,?);");
                        ps.setString(1,login);
                        ps.setString(2,password);
                        ps.executeUpdate();
                        ps.close();
                        ps = c.prepareStatement("UPDATE nauczyciele SET id_uzytkownika = ? where id=?;");
                        ps.setString(1,login);
                        ps.setInt(2, teacherID);
                        ps.executeUpdate();
                        ps.close();
                        //stmt = c.createStatement();
                        //stmt.executeUpdate("INSERT INTO uzytkownicy(login,haslo) values('" + login + "','" + password + "');");
                        //stmt.executeUpdate("UPDATE nauczyciele SET id_uzytkownika = '" + login + "' where id=" + teacherID + ";");
                        //stmt.close();
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        PreparedStatement ps = c.prepareStatement("SELECT * from uzytkownicy join uczniowie on login=id_uzytkownika where login=?;");
                        ps.setString(1,login);
                        //stmt = c.createStatement();
                        ResultSet rs = ps.executeQuery();
                        ps= c.prepareStatement("SELECT * from uzytkownicy join nauczyciele on login=id_uzytkownika where login=?';");
                        ps.setString(1,login);
                        rs = ps.executeQuery();
                        ps.close();
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
//                        e.printStackTrace();
//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean changeStudentPassword(String pesel,String password){
                        PreparedStatement ps = c.prepareStatement("select id_uzytkownika from uzytkownicy uz join uczniowie on id_uzytkownika=uz.login where pesel=?;");
                        ps.setString(1,pesel);
                        //stmt = c.createStatement();
                        ResultSet rs = ps.executeQuery();
                        //stmt.close();
                        //stmt = c.createStatement();
                        ps= c.prepareStatement("UPDATE uzytkownicy SET haslo = ? where login=?;");
                        ps.setString(1,password);
                        ps.setString(2,userID);
                        ps.executeUpdate();
                        //stmt.executeUpdate("UPDATE uzytkownicy SET haslo = '"+password+"' where login='"+userID+"';");
                        ps.close();
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean changeTeacherPassword(int id,String password){
                        //stmt = c.createStatement();
                        PreparedStatement ps = c.prepareStatement("select id_uzytkownika from uzytkownicy uz join nauczyciele on id_uzytkownika=uz.login where id=?;");
                        ps.setInt(1,id);

                        ResultSet rs = ps.executeQuery();
                        //stmt.close();
                        //stmt = c.createStatement();
                        ps=c.prepareStatement("UPDATE uzytkownicy SET haslo = '"+password+"' where login = '"+userID+"';");
                        ps.setString(1,password);
                        ps.setString(2,userID);
                        ps.executeUpdate();
                        ps.close();
                        return true;
                        return false;
//                        e.printStackTrace();
//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
//                        e.printStackTrace();
//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
//                        e.printStackTrace();
//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
//                        e.printStackTrace();
//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
//                        e.printStackTrace();
//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                //System.out.println(Pattern.matches(".*[;].*","adadada;asasas"));
                //ArrayList<Pair<Integer,String> > sub = dbManager.getStudentSubjects("95091673574");
                //for(int i=0;i<sub.size();i++) System.out.println(sub.get(i).getX()+" "+sub.get(i).getY());