java - Single time ommit field while saving to database -

scenario: have user entity, create user password encoded bcryptpasswordencoder. have form edit user. i'm doing way:

@controller @requestmapping("/users") @sessionattributes("userform") public class usercontroller {      @requestmapping(value = "/{userid}/edit", method = requestmethod.get)     public string showedituserform(@pathvariable("userid") long userid,          model model) {     model.addattribute("userform", userservice.finduserbyid(userid));     return "useredit";     }      @requestmapping(value = "/{userid}/edit", method = requestmethod.post)     public string edituser(@valid @modelattribute("userform") user          userform, bindingresult bindingresult,         @pathvariable("userid") long userid, model model, sessionstatus status) {      if (bindingresult.haserrors()) {         return "useredit";     } else {         userservice.save(userform);         status.setcomplete();         return "redirect:/users/" + userid;     } } 

problem: when submit edit form, password changes , can't login account. there way save user excluding e.g. username , password fields? or maybe there better way achieve this?

basically, there design issue database i.e., database design has mixed both security details other details.

to solve issue keeping existing design, can use below approach, recommend separate data out.

if (bindingresult.haserrors()) {    return "useredit"; } else {     user userdb = userservice.finduserbyid(userid);     //compare new & db values      //i.e., userform , userdb , update userdb     //userdb.setx(userform.getx());     //ignore pwd fields, not update them userdb object     userservice.save(userdb);     status.setcomplete();     return "redirect:/users/" + userid; } 

also, recommend not fetching security details (like passwords, etc..) database unless absolutely required view.

it populates anyway while initializing userform in method. takes password database, i'm looking solution, still use user form avoid interfering passw.

the other simplest option you can update specific fields i.e., excluding password writing hql query (in hibernate)