asp.NET login

Imports System.Data.SqlClient

Public Class login
    Inherits System.Web.UI.Page

    Dim ErrorHandling As New ErrorHandling
    'ErrorHandling is dan een class van mij die controleert op o.a. sql injection.
    Dim SqlConn As New SqlConnection(ConfigurationManager.ConnectionStrings("CorstianBoerman").ToString)

    Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
        If Session("LoggedIn") = True Then
            Server.Transfer("index.aspx")
        End If
    End Sub

    Protected Sub btnLogin_Click(sender As Object, e As EventArgs) Handles btnLogin.Click

        Dim User As String
        Dim Pass As String

        User = txtUser.Text
        Pass = txtPass.Text

        If ErrorHandling.CheckSql(User) = True Then
            Exit Sub
        ElseIf ErrorHandling.CheckSql(Pass) = True Then
            Exit Sub
        End If

        Dim SqlQuery As String
        SqlQuery = "SELECT * FROM tblUsers WHERE fld_username='" & User & "' AND fld_password='" & Pass & "'"

        Dim SqlComm As New SqlCommand(SqlQuery, SqlConn)

        SqlConn.Open()

        Dim SqlReader As SqlDataReader = SqlComm.ExecuteReader

        If SqlReader.HasRows Then

            Dim intId As Integer
            Dim strUser As String
            Dim strPass As String

            intId = SqlReader.GetInt32(0)
            strUser = SqlReader.GetString(1)
            strPass = SqlReader.GetString(2)

            If strUser = User And strPass = Pass Then
                Session("ID") = intId
                Session("User") = strUser
        Server.Transfer("~/index.aspx")
            Else
                lblMessage.Text = "Wrong username and/or password!"
            End If

        Else
            lblMessage.Text = "Wrong username and/or password!"
        End If

    End Sub
End Class