Login sikkerhedshul

Har et loginscript til en side, som hiver usr/pass ud af en accessdb.
Har dog fundet ud af det er muligt at logge ind med: AA' or password <> 'a / AA' or password <> 'a (usr/pass).
Dvs. den vel hiver første usr samt pass ud af min accessdb.

Hvordan får jeg fixet problemet?

Script:

<%
SET RS = Server.CreateObject("ADODB.Connection")
rs.Open "Driver={Microsoft Access Driver (*.mdb)}; DBQ=" & Server.MapPath("MIN_DATABASE.mdb")

If Request("mode") = "Check" then

Function unQuote(strTekst)
  strTekst = Trim(strTekst)
  unQuote = Replace(strTekst,"%","53")
End Function

    ' Gemmer formfelterne i Variabler
        strUsername = unQuote(request("username"))
        strPassword = unQuote(request("password"))

  Sql = "Select Count(*) as Found from user where (username = '" & strUsername  & "') and (password ='" & strPassword  & "')"
  Set LO = RS.Execute(Sql)
  if LO("Found") = 0 then
    Session("login") = ""
    error = "Du blev ikke godkendt af systemet"
  else
  strDSN = "DRIVER={Microsoft Access Driver (*.mdb)};DBQ=" & Server.MapPath("MIN_DATABASE.mdb")
  Set myConn = Server.CreateObject("ADODB.Connection")
  myConn.Open strDSN
  strSQL = "SELECT * FROM user where (username = '" & Request("username") & "') and (password ='" & Request("password") & "')"
  Set ez = myConn.Execute(strSQL)
    Session("login") = "yes mate"
    Response.Redirect "some_ofther_site.asp"
    EZ.Close
    RS.Close
    Conn.Close
  end if
end if
%>