Free through lesson 3

JSP & Servlets for Beginners

From standing up Tomcat yourself through the servlet lifecycle, what a JSP really is, MVC Model 2, sessions and filters, JDBC and DAOs, file uploads and security, all the way to building and deploying a war. Twenty lessons that build one library management app from the first line to the last. Every piece of code and output was produced by actually running Tomcat 11.0.25 on Java 21.

Start from lesson 1 Unlock every course

Curriculum

The 20 lessons are grouped into five chapters. Working through them in order is the best way, but you are welcome to dip into whatever interests you. Note: Java cannot run inside the browser, so try everything in the project you create in lesson 1.

Chapter 1 — Getting started and HTTP basics (lessons 1–4)

You stand up Tomcat yourself, deploy a war, and confirm that a servlet is one instance shared across many threads. By the end you have made a full pass over receiving a request and returning a response.

Setting up Tomcat and your first servlet

A servlet does nothing on its own. Preparing Tomcat yourself, deploying a 3.1KB war, and getting /bookshelf/hello to respond.

Free

The servlet lifecycle and web.xml

There is one servlet instance for the whole application. Causing the accident where ten parallel requests all see the same value, to see for yourself why instance variables are out.

Free

Getting values out of a request

getParameter returns null, not an empty string. Multiple values, numeric conversion, extracting parts of the path, and fixing encoding with two lines in web.xml.

Free

Responses and redirects

Headers and body have to be written in order. Measuring the difference between sendRedirect and forward, and confirming that "getRequestURI() does not change on a forward" is wrong.

Chapter 2 — Building screens (lessons 5–7)

You watch a JSP being converted into a servlet by opening the generated .java file. You write your screens with EL and JSTL, and compare the lifetimes of the four scopes by measurement.

What a JSP really is

A JSP is converted into a servlet before it runs. Confirming it by opening the generated .java under work/, and why scriptlets are out.

EL expressions and JSTL

Replacing scriptlets with EL and JSTL. Then confirming that ${} does not escape, by rendering the same data two ways.

The four scopes and forwarding

Comparing the lifetimes of page, request, session and application by measurement. Why attributes survive a forward but not a redirect, and the fact that new is a reserved word in EL.

Chapter 3 — The shape of the app and cross-cutting concerns (lessons 8–13)

You give the app its shape with MVC Model 2: servlets as controllers, JSPs as views. Duplicate submissions, input checking, sign-in, filters and error pages are all covered here.

Building a list screen with MVC Model 2

Servlets as controllers, JSPs as views. Taking the ID from the path, extracting a shared layout, and walking into a broken link caused by the scope of c:set.

Form submission and POST-Redirect-GET

Actually demonstrating the duplicate submission you get from the update button, then fixing it with PRG. Messages lost across the redirect are carried in flash scope.

Validation and displaying errors

Return all the errors at once, and give the values back without clearing them. And if you forget to escape when writing back into a value attribute, a single quote mark breaks out of it.

Sessions and sign-in

Measuring for yourself why changeSessionId() is called on a successful sign-in. Hashing passwords, never distinguishing why a sign-in failed, and making sign-out a POST.

Filters

Moving the authentication check out of every servlet and into a filter. @WebFilter cannot control the order, so use web.xml.

Listeners and error pages

Replacing the default error page that leaks your Tomcat version. Including the trap that an exception-type page returns 500 by default.

Chapter 4 — The database (lessons 14–17)

You replace the in-memory List with H2 and tidy it up with DAOs and a connection pool. You complete CRUD and implement search, paging and sorting.

Connecting to a database with JDBC

Inside a servlet container, Class.forName is still required. Confirming why with a diagram of the class loaders, then preventing SQL injection with PreparedStatement.

The DAO pattern and connection pooling

Shutting SQL inside a DAO and borrowing connections from a pool. That close() on a pooled connection means "return it", and why forgetting it exhausts the pool.

Completing CRUD with update and delete

Decide what to update from the URL, not a hidden field. Do not throw away the return value of executeUpdate(), and accept deletes over POST only.

Search, paging and sorting

A column name in ORDER BY cannot be a placeholder. Guarding it with an allowlist, paging with LIMIT and OFFSET, and walking into two EL traps.

Chapter 5 — Practical concerns and operations (lessons 18–20)

You break each of the four rules of safe file upload on purpose to see why they matter, then work through XSS, SQL injection and CSRF. Finally you build separate wars for production.

File uploads

Never use the filename you were sent. Guarding the destination, the filename, the extension versus the contents, and the serving side, then breaking each one on purpose.

Security (XSS, SQL injection and CSRF)

Checking that someone is signed in does not stop CSRF. Pulling together the defences touched on throughout and checking the token in one filter.

Wrapping up: building and deploying

Do not hand-edit the settings that change per environment. Building different wars with Maven profiles, and letting CI catch what you forget.

Once you have finished all 20 lessons, move on to Spring Boot, where the framework takes over the parts you wrote by hand here. Membership unlocks every course.