求助，高手进来看看。。

有一登陆界面，输入字母、符号不用密码也能进去，而且加了判断也没用，麻烦各位高手帮忙看看：
代码如下：
<!--#include file="..\Data\Data_connect.asp"-->
<%
 uid=trim(Request("user_name"))
 upwd=trim(Request("user_password"))
 role=trim(Request("user_role"))

if uid="" then
  Response.Write "<script language=JavaScript>{window.alert('登录帐号不得为空!');window.history.go(-1);}</script>"
end if
if instr(1,uid,",")>=1 then
  Response.Write "<script language=JavaScript>{window.alert('登录帐号不得包含逗号!');window.history.go(-1);}</script>"
end if
if instr(1,uid,"'")>=1 then
  Response.Write "<script language=JavaScript>{window.alert('登录帐号不得包含单引号!');window.history.go(-1);}</script>"
end if
   '判断帐号及密码是否正确
 set recCheckUser=server.CreateObject("ADODB.recordset")
 if role="教 师" then
 strSQL="select * from [user] where name_id='"&uid& "' and password='"&upwd& "'"
 recCheckUser.Open strSQL,conn,1,1
 if not recCheckUser.EOF then
     '如果用户帐号及密码正确
    session("User")=uid
    Session("Department")=recCheckUser("department")
    response.redirect "../Worker/index.asp"
 else
     '用户帐号及密码不正确
      recCheckUser.Close
      set recCheckUser=nothing
      set conn=nothing
    Response.Write "<script language=JavaScript>{window.alert('您输入的帐号及密码错误，请重新输入!');window.history.go(-1);}</script>"
 end if
 end if
 if role="管 理" then
 strSQL="select * from [admin] where name='"&uid& "' and password='"&upwd& "'"
 recCheckUser.Open strSQL,conn,1,1
 if not recCheckUser.EOF then
     '如果用户帐号及密码正确    
    session("User")=uid
    Session("Department")=recCheckUser("department")
    Session("Role")=recCheckUser("role")
    response.redirect "../System/System_Index.asp"
 else
     '用户帐号及密码不正确
      recCheckUser.Close
      set recCheckUser=nothing
      set conn=nothing
    Response.Write "<script language=JavaScript>{window.alert('您输入的管理员帐号及密码错误，请重新输入!');window.history.go(-1);}</script>"
 end if
 end if
%>