<%@ Page Language="vb" %>
<%@ Import Namespace="System.Data" %>
<%@ Import Namespace="System.Data.SqlClient" %>
<script  runat="server">
Sub Page_Load(sender As Object, e As EventArgs)	
	dim gotofile as String
	if replace(request.form("USERNAME"),"'","''")="" then 
		gotofile="login.aspx"
	end if
	Dim strSQL="select *  from tblUsers "
	strSQL +=" Where Username='" 
	strSQL += replace(request.form("USERNAME") ,"'","''") 
	strSQL += "'"
	Dim myConn As SqlConnection  = _
	New SqlConnection(ConfigurationSettings.appSettings("conn"))
	myConn.Open
	Dim myCom = New SqlCommand(strSQL, myConn)
	Dim drd as SqlDataReader 	
	drd=myCom.ExecuteReader()
	if drd.read() then					
		if drd("Password").toString() = _
			request.form("PASSWORD").toString() then							
			session.Contents("userid")=drd("UserID").toString()
			session.Contents("email")=drd("Email").toString()						
			session.Contents("fullname")=drd("Fullname").toString() 		
			gotofile="myaccount.aspx"
		else
			session.Contents("userid")="-1"
			gotofile="login.aspx"
		end if								
		
	else
		session.Contents("userid")="-2"
		gotofile="login.aspx"
	end if
	myCom.Connection.Close()
	myConn.close	
	response.redirect (gotofile)
End sub
</script>