Authentication problem ASP & SQL

Hi,

I hope someone can help me with this problem. I have a login form that posts to the asp page which I have included below. It is meant to test for correct username and password and that the Status field on the db is set to member.

However I get the following error ( "Either EOF or BOF is true") if you input the incorrect username and password. It seems the redirect code does not get executed for some reason.

Here is the code:

<%@LANGUAGE="VBSCRIPT" CODEPAGE="1252"%>
<!--#include file="Connsql.asp" -->
<%
Dim rsLogin__strUsername
rsLogin__strUsername = "xyz"
If (Request.Form("txtUsername") <> "") Then
rsLogin__strUsername = Request.Form("txtUsername")
End If
%>
<%
Dim rsLogin__strPassword
rsLogin__strPassword = "123"
If (Request.Form("txtPassword") <> "") Then
rsLogin__strPassword = Request.Form("txtPassword")
End If
%>

<%
Dim rsLogin
Dim rsLogin_numRows

Set rsLogin = Server.CreateObject("ADODB.Recordset")
rsLogin.ActiveConnection = MM_Connsql_STRING
rsLogin.Source = "SELECT * FROM Members WHERE username ='" + Replace(rsLogin__strUsername, "'", "''") + "' AND password ='" + Replace(rsLogin__strPassword, "'", "''") + "'"
rsLogin.CursorType = 0
rsLogin.CursorLocation = 2
rsLogin.LockType = 1
rsLogin.Open()

rsLogin_numRows = 0
%>

<%
If rsLogin_strUsername <> "xyz" AND rsLogin.Fields.item("id").value =member AND NOT rsLogin.EOF then
Session("svUserID") =(rsLogin.Fields.item("id").value)
Response.Cookies("ckLoggedin") ="Loggedin"
Response.Redirect "membersonly/index.asp"
Else

Response.Redirect ("loginfail.asp")
End if
%>

<%
rsLogin.Close()
Set rsLogin = Nothing

%>

That makes sense. I'll give it a try and let you know.

Mmmmm. Weird. I've tried adding another if statement before that line to test for "rslogin.EOF"

i.e

If rsLogin.EOF then
Response.Redirect("loginfail.asp
")
Else If rsLogin_strUsername <> "xyz" AND rsLogin.Fields.item("status").value = "member" then
Session("svUserID") =(rsLogin.Fields.item("id").value)
Response.Cookies("ckLoggedin") ="Loggedin"
Response.Redirect "membersonly/index.asp"
Else

Response.Redirect("loginfail.asp")
End If
%>

and it still doesn't work. Seems simple enough. Any ideas?