PreparedStatement<\/strong> object in order to build the query with parameters and sanitize possible bad characters in the external arguments.<\/p>\n\r\n\/\/ Grab a connection from the DBManager connection pool\r\nconnection = dbManager.getConnection();\r\n\r\n\/\/ Build a prepared statement\r\nPreparedStatement stmt = connection.prepareStatement("SELECT pword,id FROM muppets WHERE name=?");\r\nstmt.setString(1, userName);\r\n\r\n\/\/ Execute query\r\nResultSet res = stmt.executeQuery();\r\n<\/pre>\nAs an alternative to this approach you could use the DBManager.executeQuery(String sql, Object[] params) <\/strong>method, which works similarly without the need to work at the connection level. We didn’t use it for this example because at the time of writing it wasn’t available yet (requires SmartFoxServer 2X version RC1b or later).<\/p>\nWhen an errror is encountered (e.g. bad password), we raise an exception of type SFSLoginException<\/strong> and provide an additional error code:<\/p>\n\r\nif (!getApi().checkSecurePassword(session, dbPword, cryptedPass))\r\n{\r\n SFSErrorData data = new SFSErrorData(SFSErrorCode.LOGIN_BAD_PASSWORD);\r\n data.addParameter(userName);\r\n\r\n throw new SFSLoginException("Login failed for user: " + userName, data);\r\n}\r\n<\/pre>\nIn the case of a bad username or bad password we also specify the name or password used so that this is reported back to the client.<\/p>\n