title: Creating sessions for my login page and counting number of unsuccessful login
body: <p>This works fine. Now I wanna create a session after user logged in and also redirect to  security questions once the number of unsuccessful attempts to login is 3. How can I do that?</p>
  
  <p>How to create a user login and logout session? And how to count the number of login attempts?
  </p>
  
  <pre><code>protected void doPost(HttpServletRequest request,
          HttpServletResponse response) throws ServletException, IOException {
      try {
          Class.forName("com.mysql.jdbc.Driver");
          Connection con = DriverManager.getConnection(
                  "jdbc:mysql://localhost:3306/mutualfund", "root", "");
          Statement stmt = con.createStatement();
  
          String uname = request.getParameter("username");
          String pass = request.getParameter("password");
          String query = "SELECT * FROM `login_table` WHERE `username`=\""+uname +"\" and `password`=\""+pass+"\"";
  
          ResultSet result = stmt.executeQuery(query);            
  
          if(result.next())
          {
              System.out.println("entered into if loop");
              if (result.getString(1).equals(uname)
                      &amp;&amp; result.getString(2).equals(pass)) {
                  System.out.println("Uname and pass are correct");
                  if (result.getBoolean(7) == true) {
                      System.out.println("redirecting to admin profile");
                      response.sendRedirect("displayFunds.jsp");
                  }
                  else if ((result.getBoolean(7) == false)
                          &amp;&amp; (result.getInt(3)==0)) {
                      System.out.println("first time login for customer, redirecting to change pass");
  
                      response.sendRedirect("changePassword.jsp?name="
                              + uname + "&amp;&amp;pass=" + pass);
  
                  }
                  else if ((result.getBoolean(7) == false)
                          &amp;&amp; (result.getInt(3)==1)) {
                      System.out.println("active customer login");
                      response.sendRedirect("custProfile.jsp");
                  }
              }
  
              else {
  
                  response.sendRedirect("loginFailed.jsp");
              }
          }
  
      } catch (Exception ex) {
          Logger.getLogger(Admin.class.getName()).log(Level.SEVERE, null, ex);
      }
  
  }
  </code></pre>