ASP.Net สอบถามการ Login แบบ กำหนดสิทธิ์ รบกวนดูโค้ดให้หน่อยค่ะ

Protected Sub Login1_Authenticate(ByVal sender As Object, ByVal e As System.Web.UI.WebControls.AuthenticateEventArgs) Handles Login1.Authenticate
        Dim Username As String = Login1.UserName
        Dim Password As String = Login1.Password
        sb = New StringBuilder
        sb.Remove(0, sb.Length())
        sb.Append(" SELECT Type,Username,Password,FullName FROM tblLogin")
        sb.Append(" WHERE(Username = @Username)")
        sb.Append(" AND (Password = @Password)")
        Com = New SqlCommand(sb.ToString(), Conn)
        With Com
            .Parameters.Add("@Username", SqlDbType.VarChar).Value = Username
            .Parameters.Add("@Password", SqlDbType.VarChar).Value = Password
            dr = .ExecuteReader()
        End With
        If dr.HasRows Then
            dr.Read()

            Session("ssUsername") = dr.Item("Username").ToString
            Session("ssPassword") = dr.Item("Password").ToString
            Session("ssFullName") = dr.Item("FullName").ToString
            Session("ssType") = dr.Item("Type").ToString
            Session.Timeout = 20
            Response.Redirect("Member_Default.aspx")
        Else
            Session("ssUsername") = ""
            Session("ssPassword") = ""
            Session("ssFullName") = ""
            Session("ssType") = ""
        End If
        dr.Close()
    End Sub

 Protected Sub Login1_Authenticate(ByVal sender As Object, ByVal e As System.Web.UI.WebControls.AuthenticateEventArgs) Handles Login1.Authenticate
        Dim Username As String = Login1.UserName
        Dim Password As String = Login1.Password
        Dim Type1 As String = "0"
        sb = New StringBuilder
        sb.Remove(0, sb.Length())
        sb.Append(" SELECT Type,Username,Password,FullName FROM tblLogin")
        sb.Append(" WHERE(Username = @Username)")
        sb.Append(" AND (Password = @Password)")
        Com = New SqlCommand(sb.ToString(), Conn)
        With Com
            .Parameters.Add("@Username", SqlDbType.VarChar).Value = Username
            .Parameters.Add("@Password", SqlDbType.VarChar).Value = Password
            dr = .ExecuteReader()
        End With
        Conn.Open()
        sda.SelectCommand = Com
        sda.Fill(dt)
        If dt.Rows.Count > 0 Then
            If dt.Rows(0)("Type") = "User" Then
                Session("ssUsername") = dr.Item("Username").ToString
                Session("ssPassword") = dr.Item("Password").ToString
                Session("ssFullName") = dr.Item("FullName").ToString
                Session("ssType") = dr.Item("Type").ToString
                Session.Timeout = 20 
                Response.Redirect("Member_Default.aspx")

            Else
                Session("ssUsername") = dr.Item("Username").ToString
                Session("ssPassword") = dr.Item("Password").ToString
                Session("ssFullName") = dr.Item("FullName").ToString
                Session("ssType") = dr.Item("Type").ToString
                Session.Timeout = 20
                Response.Redirect("Addmin_Default.aspx")

            End If
        Else
            Session("ssUsername") = ""
            Session("ssPassword") = ""
            Session("ssFullName") = ""
            Session("ssType") = ""
        End If
        dr.Close()
        Conn.Close()
        sda.Dispose()
    End Sub