title: vb.net login control not re-authenticating
body: <p>I am newbie when it comes to working with the vb.net login control so bear with me...</p>
  
  <p>Tp start I am using ASP.net 4.0 and vb.net.  </p>
  
  <p>Okay so I have a simple login control that verifies the user against a sql database.  (I am hosting with hostgator so I can't use the normal windows auth).  Now the biggest probelm I am having is that if the session times out and you get redirected to the login page it doesn't matter what you type in the user name/password on the login in form it just lets you right in even if the user name and password are wrong or the user doesn't exist?  </p>
  
  <p>How do I make sure that the login control truly authenticates the user?</p>
  
  <p>Any help is greatly appreciated.
  Thanks!</p>
  
  <pre><code>Public strLoginErrorMsg As String
  Public type As String
  Public rowcount As String
  
  Protected Sub login_sbts_Authenticate(sender As Object, e As      System.Web.UI.WebControls.AuthenticateEventArgs) Handles login_sbts.Authenticate
      Dim bauthenticated As Boolean = False
      bauthenticated = isValidUser(login_sbts.UserName, login_sbts.Password)
  
      If bauthenticated Then
  
          e.Authenticated = True
      Else
          e.Authenticated = False
      End If
      lblInfo.Text = type
      FormsAuthentication.RedirectFromLoginPage(Me.login_sbts.UserName, True)
  
      If type = "ADMIN" Then
          Response.Redirect("dailynote.aspx")
      Else
          Response.Redirect("other.aspx")
      End If
  
  End Sub
  
  Private Function isValidUser(ByVal username As String, ByVal pwd As String) As [Boolean]
  
      Dim con As New SqlConnection("Data Source=localhost;Initial Catalog=sbts-scheduling;User ID=userid;Password=password;")
      Dim cmd As New SqlCommand("select * from tblusers where UserName='" &amp; username &amp; "' and Password='" &amp; pwd &amp; "'")
      cmd.Connection = con
      Dim dt As New DataTable()
      Dim da As New SqlDataAdapter(cmd)
      con.Open()
      da.Fill(dt)
      con.Close()
      If dt.Rows.Count = 0 Then
          strLoginErrorMsg = "Invalid User Name/Password"
          dt.Dispose()
          Return False
      Else
          type = dt.Rows(0).Item("UserType").Trim()
          Session("usertype") = type
  
      End If
      Return True
  
  
  
  End Function
  
  Protected Sub login_sbts_LoginError(sender As Object, e As System.EventArgs) Handles login_sbts.LoginError
      login_sbts.FailureText = strLoginErrorMsg
  End Sub
  </code></pre>