一个简单的登陆有关问题

public interface IUserDao {        public User queryByUserNameAndPassword(String userName, String password) throws Exception;}

public User queryByUserNameAndPassword(String userName, String password)            throws Exception {        String hql = "FROM User as u WHERE u.userName=? and u.password=?";           String[] str = new String[] {userName, password};           List<User> users = this.getHibernateTemplate().find(hql, str);           if (users != null && users.size() >= 1) {               return users.get(1);           } else {               return null;           }            }

 public String isLogin(String userName, String password) throws  Exception;

public String isLogin(String userName, String password) throws Exception {         User user = userDao.queryByUserNameAndPassword(userName, password);           if(user != null) {               return user.getUserName();           } else {               return null;           }    }

        public String execute() throws Exception {          if (isInvalid(user.getUserName())) {               this.addFieldError("uid", "登录ID不能为空");               return INPUT;           }           if (isInvalid(user.getPassword())) {               this.addFieldError("password", "密码项不能为空");               return INPUT;           }           String uname = userService.isLogin(user.getUserName(), user.getPassword());           if (uname != null) {               Map session = ActionContext.getContext().getSession();               session.put("uname", uname);               session.put("uid", user.getUid());               return SUCCESS;           } else {               this.addFieldError("idorpassword", "用户名或密码错误");               return INPUT;           }        }    private boolean isInvalid(String userName) {        // TODO Auto-generated method stub        return false;    }