为什么都可以,在最后的后台验证时就是不对?

为什么都可以,在最后的后台验证时就是不对?

<%@ Language=VBScript codepage ="936" %>
<%
Response.Expires = 0
Response.Expiresabsolute = Now() - 1
%>
<!--#include file="conn.asp" -->


 <%
dim UserId,Password
dim rs,sql
UserId=Request.Form("UserId")
Password=Request.Form("Password")

  sql="select * from Manage_User where Username='" & UserId & "' and PassWord='" & Password & "'"   



 set rs= Server.CreateObject("ADODB.Recordset")
 rs.open sql,conn,1,1

If rs.EOF or rs.bof Then

   response.write"<SCRIPT language=JavaScript>alert('您输入的用户名和密码不正确。');"
   response.write"this.location.href='javascript:history.back();'</SCRIPT>"
   rs.close
   set rs=nothing
else   
%>


<%
session.timeout=30   

session("username")=rs("username")
Response.Cookies("username")=rs("id")
Response.Cookies("username").expires=dateadd("h",1,now())
session("password")=rs("password")
session("LastLogin")=rs("LastLogin")
session("flag")=rs("flag")
Response.Cookies("flag")=rs("id")
Response.Cookies("flag").expires=dateadd("h",1,now())
session("del")=rs("del")
rs("LastLogin")=Now()
rs("LastLoginIP")=Request.ServerVariables("REMOTE_ADDR")
'session.timeout=1000
rs.update
rs.close
set rs=nothing
response.redirect "default.asp"
end if
%>