CVE-2015-10047 (published 2023-01-15T10:15Z)

A vulnerability was found in KYUUBl school-register. It has been classified as critical. This affects an unknown part of the file src/DBManager.java. The manipulation leads to sql injection. The patch is named 1cf7e01b878aee923f2b22cc2535c71a680e4c30. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218355.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/KYUUBl/school-register
commit_details: repo_url: https://github.com/KYUUBl/school-register
author: KYUUBl
author_date: 2015-02-05 23:37:10+01:00
msg: fuck sql injection
repository: repo_url: https://github.com/KYUUBl/school-register
repo_name: KYUUBl/school-register
description: nope
repo_language: Java
owner: KYUUBl
file_changes: filename: DBManager.java
change_type: ModificationType.MODIFY
diff: @@ -1,11 +1,9 @@
 import utils.AccountType;
 import utils.Pair;
 
-import java.sql.Connection;
-import java.sql.DriverManager;
-import java.sql.ResultSet;
-import java.sql.Statement;
+import java.sql.*;
 import java.util.ArrayList;
+import java.util.regex.Pattern;
 
 public class DBManager {
         Connection c;
@@ -41,8 +39,9 @@ public class DBManager {
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return grades;
         }
@@ -62,8 +61,9 @@ public class DBManager {
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return absences;
         }
@@ -84,8 +84,9 @@ public class DBManager {
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return notes;
         }
@@ -105,8 +106,9 @@ public class DBManager {
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return subjects;
         }
@@ -128,8 +130,9 @@ public class DBManager {
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return subjects;
         }
@@ -151,168 +154,262 @@ public class DBManager {
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return students;
         }
 
-        public void addStudentGrade(int subjectID, String studentID, int gradeValue, int activityID, String topic) {
+        public boolean addStudentGrade(int subjectID, String studentID, int gradeValue, int activityID, String topic) {
                 try {
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("INSERT INTO oceny_uczniow(id_przedmiotu,id_ucznia,wartosc,id_aktywnosci,tematyka) values(" + subjectID + "," + studentID + "," + gradeValue + "," + activityID + ",'" + topic + "');");
+                        PreparedStatement ps = c.prepareStatement("INSERT INTO oceny_uczniow(id_przedmiotu,id_ucznia,wartosc,id_aktywnosci,tematyka) values(?,?,?,?,?);");
+                        ps.setInt(1,subjectID);
+                        ps.setString(2, studentID);
+                        ps.setInt(3,gradeValue);
+                        ps.setInt(4,activityID);
+                        ps.setString(5,topic);
+                        ps.executeUpdate();
+                        ps.close();
+                        //stmt = c.createStatement();
+                        //stmt.executeUpdate("INSERT INTO oceny_uczniow(id_przedmiotu,id_ucznia,wartosc,id_aktywnosci,tematyka) values(" + subjectID + "," + studentID + "," + gradeValue + "," + activityID + ",'" + topic + "');");
 //                        System.out.println("success");
-                        stmt.close();
+                        //stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void addStudentNote(String studentID, int teacherID, String note, boolean isPositive, String date) {
+        public boolean addStudentNote(String studentID, int teacherID, String note, boolean isPositive, String date) {
                 try {
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("INSERT INTO uwagi(id_ucznia,id_nauczyciela,opis,czy_pozytywna,data_wystawienia) values('" + studentID + "'," + teacherID + ",'" + note + "'," + isPositive + ",to_date('" + date + "', 'DD.MM.YYYY'));");
+                        PreparedStatement ps =c.prepareStatement("INSERT INTO uwagi(id_ucznia,id_nauczyciela,opis,czy_pozytywna,data_wystawienia) values(?,?,?,?,to_date(?, 'DD.MM.YYYY'));");
+                        ps.setString(1,studentID);
+                        ps.setInt(2, teacherID);
+                        ps.setString(3, note);
+                        ps.setBoolean(4, isPositive);
+                        ps.setString(5, date);
+                        ps.executeUpdate();
+                        ps.close();
+                        //stmt = c.createStatement();
+                        //stmt.executeUpdate("INSERT INTO uwagi(id_ucznia,id_nauczyciela,opis,czy_pozytywna,data_wystawienia) values('" + studentID + "'," + teacherID + ",'" + note + "'," + isPositive + ",to_date('" + date + "', 'DD.MM.YYYY'));");
 //                        System.out.println("success");
-                        stmt.close();
+                        //stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void addStudentAbsence(String studentID, int lessonID) {
+        public boolean addStudentAbsence(String studentID, int lessonID) {
                 try {
                         stmt = c.createStatement();
                         stmt.executeUpdate("INSERT INTO nieobecnosci(id_ucznia,id_lekcji) values('" + studentID + "'," + lessonID + ");");
 //                        System.out.println("success");
                         stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
         public int addCompletedLesson(String data, int teacherID, int lessonID, String topic) {
                 int i=-1;
                 try {
+                        PreparedStatement ps = c.prepareStatement("INSERT INTO przeprowadzone_lekcje(data,id_prowadzacego,id_lekcji,temat_zajec) values(to_date(?, 'DD.MM.YYYY'),?,?,?);");
+                        ps.setString(1,data);
+                        ps.setInt(2,teacherID);
+                        ps.setInt(3,lessonID);
+                        ps.setString(4,topic);
+                        ps.executeUpdate();
+                        ps.close();
                         stmt = c.createStatement();
-                        stmt.executeUpdate("INSERT INTO przeprowadzone_lekcje(data,id_prowadzacego,id_lekcji,temat_zajec) values(to_date('" + data + "', 'DD.MM.YYYY')," + teacherID + "," + lessonID + ",'" + topic + "');");
+                        //stmt.executeUpdate("INSERT INTO przeprowadzone_lekcje(data,id_prowadzacego,id_lekcji,temat_zajec) values(to_date('" + data + "', 'DD.MM.YYYY')," + teacherID + "," + lessonID + ",'" + topic + "');");
 //                        System.out.println("success");
                         ResultSet rs = stmt.executeQuery("select lastval();");
                         rs.next();
                         i=rs.getInt(1);
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return -1;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return i;
         }
 
-        public void addStudent(String name, String lastname, String pesel, int phoneNumber, int classID) {
+        public boolean addStudent(String name, String lastname, String pesel, int phoneNumber, int classID) {
                 try {
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("INSERT INTO uczniowie(imie,nazwisko,pesel,telefon_do_rodzica,id_klasy) values('" + name + "','" + lastname + "','" + pesel + "'," + phoneNumber + "," + classID + ");");
+                        PreparedStatement ps = c.prepareStatement("INSERT INTO uczniowie(imie,nazwisko,pesel,telefon_do_rodzica,id_klasy) values(?,?,?,?,?);");
+                        ps.setString(1,name);
+                        ps.setString(2,lastname);
+                        ps.setString(3,pesel);
+                        ps.setInt(4,phoneNumber);
+                        ps.setInt(5,classID);
+                        ps.executeUpdate();
+                        ps.close();
+                        //stmt = c.createStatement();
+                        //stmt.executeUpdate("INSERT INTO uczniowie(imie,nazwisko,pesel,telefon_do_rodzica,id_klasy) values('" + name + "','" + lastname + "','" + pesel + "'," + phoneNumber + "," + classID + ");");
 //                        System.out.println("success");
-                        stmt.close();
+                        //stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void addclass(String section, int startYear, int tutorID) {
+        public boolean addclass(String section, int startYear, int tutorID) {
                 try {
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("INSERT INTO klasy(oddzial,rok_rozpoczecia,id_wychowawcy) values('" + section + "'," + startYear + "," + tutorID + ");");
+                        PreparedStatement ps = c.prepareStatement("INSERT INTO klasy(oddzial,rok_rozpoczecia,id_wychowawcy) values(?,?,?);");
+                        ps.setString(1,section);
+                        ps.setInt(2,startYear);
+                        ps.setInt(3,tutorID);
+                        ps.executeUpdate();
+                        ps.close();
+//                        stmt = c.createStatement();
+//                        stmt.executeUpdate("INSERT INTO klasy(oddzial,rok_rozpoczecia,id_wychowawcy) values('" + section + "'," + startYear + "," + tutorID + ");");
 //                        System.out.println("success");
-                        stmt.close();
+//                        stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+//                        e.printStackTrace();
+//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void addTeacher(String name, String lastname) {
+        public boolean addTeacher(String name, String lastname) {
                 try {
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("INSERT INTO nauczyciele(imie,nazwisko) values('" + name + "','" + lastname + "');");
+                        PreparedStatement ps = c.prepareStatement("INSERT INTO nauczyciele(imie,nazwisko) values(?,?);");
+                        ps.setString(1,name);
+                        ps.setString(2,lastname);
+                        ps.executeUpdate();
+                        ps.close();
+//                        stmt = c.createStatement();
+//                        stmt.executeUpdate("INSERT INTO nauczyciele(imie,nazwisko) values('" + name + "','" + lastname + "');");
 //                        System.out.println("success");
-                        stmt.close();
+//                        stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void addSubject(String name, int classID, int teacherID) {
+        public boolean addSubject(String name, int classID, int teacherID) {
                 try {
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("INSERT INTO przedmioty(nazwa,id_klasy,id_prowadzacego) values('" + name + "'," + classID + "," + teacherID + ");");
+                        PreparedStatement ps = c.prepareStatement("INSERT INTO przedmioty(nazwa,id_klasy,id_prowadzacego) values(?,?,?);");
+                        ps.setString(1,name);
+                        ps.setInt(2,classID);
+                        ps.setInt(3,teacherID);
+                        ps.executeUpdate();
+                        ps.close();
+//                        stmt = c.createStatement();
+//                        stmt.executeUpdate("INSERT INTO przedmioty(nazwa,id_klasy,id_prowadzacego) values('" + name + "'," + classID + "," + teacherID + ");");
 //                        System.out.println("success");
-                        stmt.close();
+//                        stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void addScheduleLesson(int subjectID, int lessonNumber, int weekday) {
+        public boolean addScheduleLesson(int subjectID, int lessonNumber, int weekday) {
                 try {
                         stmt = c.createStatement();
                         stmt.executeUpdate("INSERT INTO plan_lekcji(id_przedmiotu,nr_lekcji,dzien_tygodnia) values(" + subjectID + "," + lessonNumber + "," + weekday + ");");
 //                        System.out.println("success");
                         stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void yearEnd() {
+        public boolean yearEnd() {
                 try {
                         stmt = c.createStatement();
                         stmt.executeUpdate("UPDATE przedmioty SET aktywny = FALSE;");
                         stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void deactivateStudent(String studentID) {
+        public boolean deactivateStudent(String studentID) {
                 try {
                         stmt = c.createStatement();
                         stmt.executeUpdate("UPDATE uczniowie SET aktywny = false where pesel='" + studentID + "';");
                         stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void addStudentUser(String login, String password, String pesel) {
+        public boolean addStudentUser(String login, String password, String pesel) {
                 try {
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("INSERT INTO uzytkownicy(login,haslo) values('" + login + "','" + password + "');");
-                        stmt.executeUpdate("UPDATE uczniowie SET id_uzytkownika = '" + login + "' where pesel='" + pesel + "';");
-                        stmt.close();
+                        PreparedStatement ps = c.prepareStatement("INSERT INTO uzytkownicy(login,haslo) values(?,?);");
+                        ps.setString(1,login);
+                        ps.setString(2,password);
+                        ps.executeUpdate();
+                        ps.close();
+                        ps = c.prepareStatement("UPDATE uczniowie SET id_uzytkownika = ? where pesel=?;");
+                        ps.setString(1,login);
+                        ps.setString(2,pesel);
+                        ps.executeUpdate();
+                        ps.close();
+//                        stmt = c.createStatement();
+//                        stmt.executeUpdate("INSERT INTO uzytkownicy(login,haslo) values('" + login + "','" + password + "');");
+//                        stmt.executeUpdate("UPDATE uczniowie SET id_uzytkownika = '" + login + "' where pesel='" + pesel + "';");
+//                        stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
-        public void addTeacherUser(String login, String password, int teacherID) {
+        public boolean addTeacherUser(String login, String password, int teacherID) {
                 try {
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("INSERT INTO uzytkownicy(login,haslo) values('" + login + "','" + password + "');");
-                        stmt.executeUpdate("UPDATE nauczyciele SET id_uzytkownika = '" + login + "' where id=" + teacherID + ";");
-                        stmt.close();
+                        PreparedStatement ps = c.prepareStatement("INSERT INTO uzytkownicy(login,haslo) values(?,?);");
+                        ps.setString(1,login);
+                        ps.setString(2,password);
+                        ps.executeUpdate();
+                        ps.close();
+                        ps = c.prepareStatement("UPDATE nauczyciele SET id_uzytkownika = ? where id=?;");
+                        ps.setString(1,login);
+                        ps.setInt(2, teacherID);
+                        ps.executeUpdate();
+                        ps.close();
+                        //stmt = c.createStatement();
+                        //stmt.executeUpdate("INSERT INTO uzytkownicy(login,haslo) values('" + login + "','" + password + "');");
+                        //stmt.executeUpdate("UPDATE nauczyciele SET id_uzytkownika = '" + login + "' where id=" + teacherID + ";");
+                        //stmt.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
@@ -321,21 +418,26 @@ public class DBManager {
                 //i true jesli to uczen, false jesli to nauczyciel
                 //null jesli login nie istnieje lub zle haslo
                 try {
-                        stmt = c.createStatement();
-                        ResultSet rs = stmt.executeQuery("SELECT * from uzytkownicy join uczniowie on login=id_uzytkownika where login='" + login + "';");
+                        PreparedStatement ps = c.prepareStatement("SELECT * from uzytkownicy join uczniowie on login=id_uzytkownika where login=?;");
+                        ps.setString(1,login);
+                        //stmt = c.createStatement();
+                        ResultSet rs = ps.executeQuery();
                         while (rs.next()) {
                                 String pesel = rs.getString("pesel");
                                 String pass= rs.getString("haslo");
                                 if (!password.equals(pass)) return null;
                                 return new User(pesel, AccountType.STUDENT,pass);
                         }
-                        rs = stmt.executeQuery("SELECT * from uzytkownicy join nauczyciele on login=id_uzytkownika where login='" + login + "';");
+                        ps= c.prepareStatement("SELECT * from uzytkownicy join nauczyciele on login=id_uzytkownika where login=?';");
+                        ps.setString(1,login);
+                        rs = ps.executeQuery();
                         while (rs.next()) {
                                 int id = rs.getInt("id");
                                 String pass= rs.getString("haslo");
                                 if (!password.equals(pass)) return null;
                                 return new User(Integer.toString(id), AccountType.TEACHER,pass);
                         }
+                        ps.close();
                         return null;
                 } catch (Exception e) {
                         e.printStackTrace();
@@ -366,8 +468,9 @@ public class DBManager {
                         }
 //                        System.out.println("success");
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return shedule;
         }
@@ -385,8 +488,9 @@ public class DBManager {
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return students;
         }
@@ -404,39 +508,56 @@ public class DBManager {
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+//                        e.printStackTrace();
+//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return teachers;
         }
-        public void changeStudentPassword(String pesel,String password){
+        public boolean changeStudentPassword(String pesel,String password){
                 try {
-                        stmt = c.createStatement();
-                        ResultSet rs = stmt.executeQuery("select id_uzytkownika from uzytkownicy uz join uczniowie on id_uzytkownika=uz.login where pesel='" + pesel + "';");
+                        PreparedStatement ps = c.prepareStatement("select id_uzytkownika from uzytkownicy uz join uczniowie on id_uzytkownika=uz.login where pesel=?;");
+                        ps.setString(1,pesel);
+                        //stmt = c.createStatement();
+                        ResultSet rs = ps.executeQuery();
                         rs.next();
                         String userID = rs.getString("id_uzytkownika");
-                        stmt.close();
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("UPDATE uzytkownicy SET haslo = '"+password+"' where login='"+userID+"';");
-                        stmt.close();
+                        //stmt.close();
+                        //stmt = c.createStatement();
+                        ps= c.prepareStatement("UPDATE uzytkownicy SET haslo = ? where login=?;");
+                        ps.setString(1,password);
+                        ps.setString(2,userID);
+                        ps.executeUpdate();
+                        //stmt.executeUpdate("UPDATE uzytkownicy SET haslo = '"+password+"' where login='"+userID+"';");
+                        ps.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
-        public void changeTeacherPassword(int id,String password){
+        public boolean changeTeacherPassword(int id,String password){
                 try {
-                        stmt = c.createStatement();
-                        ResultSet rs = stmt.executeQuery("select id_uzytkownika from uzytkownicy uz join nauczyciele on id_uzytkownika=uz.login where id=" + id + ";");
+                        //stmt = c.createStatement();
+                        PreparedStatement ps = c.prepareStatement("select id_uzytkownika from uzytkownicy uz join nauczyciele on id_uzytkownika=uz.login where id=?;");
+                        ps.setInt(1,id);
+
+                        ResultSet rs = ps.executeQuery();
                         rs.next();
                         String userID = rs.getString("id_uzytkownika");
-                        stmt.close();
-                        stmt = c.createStatement();
-                        stmt.executeUpdate("UPDATE uzytkownicy SET haslo = '"+password+"' where login = '"+userID+"';");
-                        stmt.close();
+                        //stmt.close();
+                        //stmt = c.createStatement();
+                        ps=c.prepareStatement("UPDATE uzytkownicy SET haslo = '"+password+"' where login = '"+userID+"';");
+                        ps.setString(1,password);
+                        ps.setString(2,userID);
+                        ps.executeUpdate();
+                        ps.close();
+                        return true;
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return false;
+//                        e.printStackTrace();
+//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
         }
 
@@ -454,8 +575,9 @@ public class DBManager {
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+//                        e.printStackTrace();
+//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return activities;
         }
@@ -476,8 +598,9 @@ public class DBManager {
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return lessons;
         }
@@ -496,8 +619,9 @@ public class DBManager {
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return students;
         }
@@ -512,8 +636,9 @@ public class DBManager {
                         }
                         stmt.close();
                 }catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+//                        e.printStackTrace();
+//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return classes;
         }
@@ -531,8 +656,9 @@ public class DBManager {
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return students;
         }
@@ -550,8 +676,9 @@ public class DBManager {
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return students;
         }
@@ -570,8 +697,9 @@ public class DBManager {
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+                        //e.printStackTrace();
+                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return teachers;
         }
@@ -590,8 +718,9 @@ public class DBManager {
                         rs.close();
                         stmt.close();
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+//                        e.printStackTrace();
+//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return teachers;
         }
@@ -617,13 +746,13 @@ public class DBManager {
                         }
 //                        System.out.println("success");
                 } catch (Exception e) {
-                        e.printStackTrace();
-                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
+                        return null;
+//                        e.printStackTrace();
+//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                 }
                 return shedule;
         }
 
-
         public static void main(String args[])
         {
                 DBManager dbManager = new DBManager();
@@ -635,9 +764,8 @@ public class DBManager {
                 //System.out.printf("%-20s %s",c,a+"\n");
                 //dbManager.changeStudentPassword("95091673574","kamil");
                // dbManager.getTeachersWithoutClass();
-
-
-                ArrayList<Pair<Integer,String> > sub = dbManager.getStudentSubjects("95091673574");
-                for(int i=0;i<sub.size();i++) System.out.println(sub.get(i).getX()+" "+sub.get(i).getY());
+                //System.out.println(Pattern.matches(".*[;].*","adadada;asasas"));
+                //ArrayList<Pair<Integer,String> > sub = dbManager.getStudentSubjects("95091673574");
+                //for(int i=0;i<sub.size();i++) System.out.println(sub.get(i).getX()+" "+sub.get(i).getY());
         }
 }

programming_language: Java