<appSettings>
		<add key="strConn" value="Provider = Microsoft.Jet.OLEDB.4.0;Data Source=C:\Documents and Settings\Administrator\My Documents\tke\bin\Database.mdb;User ID=Admin;Password=;" />
	</appSettings>
<authentication mode="Forms">
			<forms name="DBLogin" loginUrl="login.aspx" /> 
		</authentication>

SELECT scroll_numb
FROM tbl_alumni_login
WHERE (((username)=[@UserName]) AND ((Password)=[@Password]));

Function DBConnection(ByVal strUserName As String, ByVal strPassword As String) As Boolean

Dim MyConn As OleDbConnection = New OleDbConnection(ConfigurationSettings.AppSettings("strConn"))
Dim MyCmd As New OleDbCommand("sp_alumni_login", MyConn)
        MyCmd.CommandType = CommandType.StoredProcedure

Dim objParam1, objParam2 As OleDbParameter

objParam1 = MyCmd.Parameters.Add("@UserName", OleDbType.Char)
objParam2 = MyCmd.Parameters.Add("@Password", OleDbType.Char)

objParam1.Direction = ParameterDirection.Input
objParam2.Direction = ParameterDirection.Input
        
objParam1.Value = txtUserName.Text
objParam2.Value = txtPassword.Text


Try
            If MyConn.State = ConnectionState.Closed Then
                   MyConn.Open()
            End If

            Dim objReader As OleDbDataReader
            objReader = MyCmd.ExecuteReader(CommandBehavior.CloseConnection)

            While objReader.Read()

                If CStr(objReader.GetValue(0)) <> "1" Then
                    lblMessage.Text = "Invalid Login!"
                Else
                    objReader.Close()  
                    Return True
                End If
            End While
        Catch ex As Exception
            lblMessage.Text = "Error Connecting to Database!"
        End Try


    End Function

If Page.IsValid Then   

            Dim intMaxLoginAttempts = CInt(Session("Num_of_Tries"))

            If DBConnection(txtUserName.Text.Trim(), txtPassword.Text.Trim()) Then
                Session("Logged_IN") = "Yes"    
                FormsAuthentication.RedirectFromLoginPage(txtUserName.Text, False) 
            Else
                 lblMessage.Text = "Invalid Login!" 
                Session("LoginCount") = CInt(Session("LoginCount")) + 1
              
                If Session("LoginCount").Equals(intMaxLoginAttempts) Then
                    Response.Redirect("Denied.aspx")
                End If

                If CInt(Session("Num_of_Tries")) > 2 Then   
                    Response.Redirect("Denied.aspx")
                End If

            End If
        End If

Response.Cache.SetCacheability(HttpCacheability.NoCache)
        If Session("Logged_IN").Equals("No") Then
            Response.Redirect("login.aspx")
        End If

Session("Num_of_Tries") = 3
        Session("LoginCount") = 0
        Session("Logged_IN") = "No"