stmt2 = conn.prepareStatement("INSERT INTO " + table
stmt = conn.prepareStatement("INSERT INTO " + table
  public void doGet(HttpServletRequest request, HttpServletResponse response)      throws IOException, ServletException  {    ServletPrinter    sp = null;    PreparedStatement stmt = null, stmt2 = null;    Connection        conn = null;    String categoryName, nickname, title, body, category, table;    String password = null;    int userId, access;    ResultSet rs = null;    int updateResult;    sp = new ServletPrinter(response, "StoreStory");    nickname = request.getParameter("nickname");    password = request.getParameter("password");    title = request.getParameter("title");    body = request.getParameter("body");    category = request.getParameter("category");    if (title == null)    {      sp.printHTML("You must provide a story title!<br>");      return;    }    if (body == null)    {      sp.printHTML("<h3>You must provide a story body!<br></h3>");      return;    }    if (category == null)    {      sp.printHTML("<h3>You must provide a category!<br></h3>");      return;    }    sp.printHTMLheader("RUBBoS: Story submission result");    sp.printHTML("<center><h2>Story submission result:</h2></center><p>\n");    //Authenticate the user    userId = 0;    access = 0;    conn = getConnection();    if ((nickname != null) && (password != null))    {      try      {        stmt = conn            .prepareStatement("SELECT id,access FROM users WHERE nickname=\""                + nickname + "\" AND password=\"" + password + "\"");        rs = stmt.executeQuery();      }      catch (Exception e)      {        sp.printHTML("ERROR: Authentification query failed" + e);        closeConnection(stmt, conn);        return;      }      try      {        if (rs.first())        {          userId = rs.getInt("id");          access = rs.getInt("access");        }      }      catch (Exception e)      {        sp.printHTML("Exception storing story " + e + "<br>");        closeConnection(stmt, conn);        return;      }    }    table = "submissions";    if (userId == 0)      sp.printHTML("Story stored by the 'Anonymous Coward'<br>\n");    else    {      if (access == 0)        sp.printHTML("Story submitted by regular user " + userId + "<br>\n");      else      {        sp.printHTML("Story posted by author " + userId + "<br>\n");        table = "stories";      }    }    // Add story to database    try    {      stmt2 = conn.prepareStatement("INSERT INTO " + table          + " VALUES (NULL, \"" + title + "\", \"" + body + "\", NOW(), \""          + userId + "\", " + category + ")");      updateResult = stmt2.executeUpdate();      if (updateResult != 1)      {        sp.printHTML(" ERROR: Failed to insert new story in database. Number of rows updated == " + updateResult +".");        closeConnection(stmt, conn);        return;      }    }    catch (SQLException e)    {      sp.printHTML("Failed to execute Query for StoreStory: " + e);      closeConnection(stmt, conn);      return;    }    closeConnection(stmt, conn);    sp.printHTML("Your story has been successfully stored in the " + table        + " database table<br>\n");    sp.printHTMLfooter();  }