asp简单的判断用户登陆和给session的过程

<%dim rs,varname,varpassword
if request.Form("name")<>"" and request.form("password")<>"" then
varname=request.form("name")
varpassword=request.form ("password")
strsql="select * from users where name='"&varname&"' and password='"&varpassword&"'"
set rs=conn.execute(strsql)
if not rs.eof and not rs.bof then
session("id")=rs("id")
session("name")=rs("name")
session("ischecked")=rs("ischecked")
session("ismanager")=rs("ismanager")
response.Redirect "main.asp"
else
response.write "用户名或密码错误！"%>
<a href="login.asp">返回登陆界面</a>
<%end if
else
response.write "用户名或密码不能为空！"%>
<a href=" login.asp">返回登陆界面</a>
<%
end if
%>