Sikkerhed i login !

Hvordan undgår man at man kan gå uden om et loginsystem ved at bruge følgende:

Felt for brugernavn: 1' OR '1' = '1
Felt for passsword: 1' OR '1' = '1


?


login ser således ud:


Dim user, pass
user = Trim(Request.Form("username"))
pass = Trim(Request.Form("password"))
user = Replace(user,"'","''")
user = Replace(pass,"'","''")
Dim cn, cnstr

set cn = server.createobject("adodb.connection")
cnstr = "Provider=Microsoft.Jet.OLEDB.4.0;"
cnstr = cnstr & "Data Source=" & server.mappath("db.mdb") & ";"
cn.connectionstring = cnstr
cn.open

Dim rs, sql
set rs = server.createobject("adodb.recordset")
sql = "Select * from users Where brugernavn='"& user & "' And password='" & pass & "';"
rs.open sql, cn

If Not rs.eof Then
    Session("crew") = True
    Session("IP") = Request.ServerVariables("REMOTE_ADDR")
    Session("dato") = formatdatetime(date,1)
    Response.Redirect("../asp/admin.asp?mode=admin")
   
Else Session("crew") = Not True
    Response.Redirect("../asp/admin.asp?mode=fejl&type=1")
End If   

rs.close
set rs = nothing
cn.close
set cn = nothing