求助，高手进来看看。。

有一登陆界面，输入字母、符号不用密码也能进去，而且加了判断也没用，麻烦各位高手帮忙看看：
代码如下：
<!--#include file="..\Data\Data_connect.asp"-->
<%
uid=trim(Request("user_name"))
upwd=trim(Request("user_password"))
role=trim(Request("user_role"))

if uid="" then
  Response.Write "<script language=JavaScript>{window.alert('登录帐号不得为空!');window.history.go(-1);}</script>"
end if
if instr(1,uid,",")>=1 then
  Response.Write "<script language=JavaScript>{window.alert('登录帐号不得包含逗号!');window.history.go(-1);}</script>"
end if
if instr(1,uid,"'")>=1 then
  Response.Write "<script language=JavaScript>{window.alert('登录帐号不得包含单引号!');window.history.go(-1);}</script>"
end if
   '判断帐号及密码是否正确
set recCheckUser=server.CreateObject("ADODB.recordset")
if role="教 师" then
strSQL="select * from [user] where name_id='"&uid& "' and password='"&upwd& "'"
recCheckUser.Open strSQL,conn,1,1
if not recCheckUser.EOF then
    '如果用户帐号及密码正确
    session("User")=uid
    Session("Department")=recCheckUser("department")
    response.redirect "../Worker/index.asp"
else
    '用户帐号及密码不正确
      recCheckUser.Close
      set recCheckUser=nothing
      set conn=nothing
    Response.Write "<script language=JavaScript>{window.alert('您输入的帐号及密码错误，请重新输入!');window.history.go(-1);}</script>"
end if
end if
if role="管 理" then
strSQL="select * from [admin] where name='"&uid& "' and password='"&upwd& "'"
recCheckUser.Open strSQL,conn,1,1
if not recCheckUser.EOF then
    '如果用户帐号及密码正确    
    session("User")=uid
    Session("Department")=recCheckUser("department")
    Session("Role")=recCheckUser("role")
    response.redirect "../System/System_Index.asp"
else
    '用户帐号及密码不正确
      recCheckUser.Close
      set recCheckUser=nothing
      set conn=nothing
    Response.Write "<script language=JavaScript>{window.alert('您输入的管理员帐号及密码错误，请重新输入!');window.history.go(-1);}</script>"
end if
end if
%>

判断的地方好像有点问题。自己再检查一下吧！我不太懂asp