if (string.Compare(TBCheckCode.Text, Session["CheckCodeI"].ToString(), true) == 0)
        {
            string password = FormsAuthentication.HashPasswordForStoringInConfigFile(TBpassword.Text, "md5");//MD5加密
            string mycon = ConfigurationManager.ConnectionStrings["EPS_WEBConnectionString"].ConnectionString;
            SqlConnection con = new SqlConnection(mycon);
            con.Open();
            SqlParameter tetusername = new SqlParameter("@username", SqlDbType.Char, 30);
            tetusername.Value = http://www.mamicode.com/TBusername.Text;
            SqlParameter tetpassword = new SqlParameter("@userpass", SqlDbType.Char, 40);
            tetpassword.Value = http://www.mamicode.com/password;
            string strsql = "select * from admin_user where UserName=@username and Password=@userpass";
            SqlCommand mycommand = new SqlCommand(strsql, con);
            mycommand.Parameters.Add(tetusername);
            mycommand.Parameters.Add(tetpassword);
            SqlDataReader rs = mycommand.ExecuteReader();
            if (rs.Read())
            {
                if (password == rs["Password"].ToString())
                {
                    Session.Timeout = 120;
                    Session["UserName"] = TBusername.Text;
                    Session["UserID"] = rs["ID"].ToString();
                    con.Close();
                    Response.Redirect("index.htm");
                    //  Response.Write("<script >window.open(‘index.htm‘);</script>");
                }
                else
                {
                    con.Close();
                    Label1.Visible = true;
                    Label1.Text = "对不起，您输入的密码有误！";
                    return;
                }
            }
            else
            {
                con.Close();
                Label1.Visible = true;
                Label1.Text = "对不起，帐号或密码错误！";
                return;
            }
        }
        else
        {
            Label1.Visible = true;
            Label1.Text = "对不起，驗證碼錯誤！";
            return;
        } 

用戶登陸。防SQL注入，驗證碼不區分大小寫。。