protected void processRequest(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        response.setContentType("text/html;charset=UTF-8");
        String user_id = request.getParameter("user_id");
        String password = request.getParameter("password");
        String errorMsg = null;
        
        if (user_id == null || user_id.equals("") || password == null || password.equals("")) {
            invalidUser(request, response);
        } else {

            Connection con = (Connection) getServletContext().getAttribute("DBConnection");
            PreparedStatement ps = null;
            ResultSet rs = null;
            Statement stmt = null;
            
            try {
                ps = con.prepareStatement("select * from Users where name=? and pass=?");
                ps.setString(1, user_id);
                ps.setString(2, password);
                stmt = con.createStatement();
                String query = "select * from Users where name= \"" + user_id + "\" and pass= \"" + password + "\"";
                rs = stmt.executeQuery(query);
                
                if(injectionProtection){
                    rs = ps.executeQuery();
                } else {
                    rs = stmt.executeQuery(query);
                }
                
                if (rs != null && rs.first()) {
                    setupSession(request, response, con, user_id, injectionProtection);
                } else {
                    invalidUser(request, response);
                }
            } catch (Exception e) {
                e.printStackTrace();
                throw new ServletException("DB Connection Problem");
            } finally {
                try {
                    rs.close();
                    ps.close();
                } catch(SQLException e) {
                    e.printStackTrace();
                }
            }
        }        
    }