FormsAuthentication Problem

[thecoolone]

I have an index.aspx page containing a button and the code in btn click
is
private void Button1_Click(object sender, System.EventArgs e)
{
if(User.Identity.IsAuthenticated)
{
Session["name"]=User.Identity.Name.ToString();
Server.Transfer("welcome.aspx");
}
else
{
Server.Transfer("login.aspx");
}
}
so when an unauthenticated user logs in it shld direct to login page.
and on my login.aspx page the code in submit btn is

private void Button1_Click(object sender, System.EventArgs e)
{

Session["name"]=TextBox1.Text;
string user = TextBox1.Text;
string pwd = TextBox2.Text;

SqlConnection sql = new SqlConnection("data source=localhost;user
id=sa;pwd=;database=bank");
sql.Open();
SqlCommand cmd = new SqlCommand("select * from customer where
cid='"+user+"' and pwd='"+pwd+"'",sql);
SqlDataReader dr = cmd.ExecuteReader();
while(dr.Read())
{
FormsAuthentication.SetAuthCookie(user,ChkBox1.Checked);
FormsAuthentication.GetRedirectUrl(user,ChkBox1.Checked);
Server.Transfer("welcome.aspx");
}

lb3.Text="Username and Password typed are incorrect. Please Retry";

}

so whenever a user's authentication is verified he shld be redirected
to thw welcome.aspx page...but the strage thing is that it doesnt. The
page is redirected to my index.aspx page.
Somethin strange is happenin with the ReturnUrl=?.

my questions are:
1) what shld i do so that authenticated users can go to the
welcome.aspx page after authentication instead of the index.aspx page?

2) when i tried changin my web.congig setting's to loginUrl=login.aspx
(currently it is index.aspx coz i want unauthenticated users to go to
the home page) I am unable to put a hyperlink that goes to the
index.aspx page. Even on clicking the hyperlink it remains in the
login.aspx page. Why is this happening ? and how to put a
hyperlink/button so that it goes to the index.aspx page?

 

[Guest]

Rule one of security.
Don't write your own authentication code.
what about user "or 1=1" that might work
or user * might work too.