codice:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml">


<head runat="server">
    <title></title>
    <style type="text/css">
        #form1
        {
            width: 308px;
            height: 191px;
        }
    </style>
</head>


<script runat="server">
Dim connectionString As String = xConn
Dim query As String
Query = "SELECT * FROM Utenti WHERE Username='" & txtUser.Text & "' AND Password='" & txtPass.Text & "'"
Dim conn As New OleDb.OleDbConnection(connectionString)
Dim cmd As New OleDb.OleDbCommand(query, conn)
Dim reader As OleDb.OleDbDataReader

Try
   conn.Open()
   reader = cmd.ExecuteReader
   If reader.Read() Then
     ' Controllo necessario per il case sensitive
     If txtUser.Text = reader("Username") And txtPass.Text = reader("Password") Then
       ' Aggiungo l'utente alla sessione ed effettuo il redirect alla Home 
       Session.Add("Username", txtUser.Text) 
       Response.Redirect("Default.aspx")
     Else
       ' Username o Password errate 
     End If
   Else
     ' Username o Password errate
   End If
Catch ex As Exception
   ' Errore
Finally
   ' Se la connessione è rimasta aperta, la chiudo 
   If Not conn Is Nothing Then
     conn.Close()
   End If
End Try
</script>


<html>
<body>
    <form id="form1" runat="server">
    <div>
    
    </div>
    USERNAME<asp:TextBox ID="txtUser" runat="server"></asp:TextBox>
    


        PASSWORD<asp:TextBox ID="txtPass" runat="server" TextMode="Password" 
            Width="123px"></asp:TextBox>
    </p>
    


<asp:Button ID="btnLogin" runat="server" onclientclick="" Text="login" />
</form>
</p>
</body>
</html>
non ti accorgi che il codice è mischiato ?