一段看似安全的ASP代码

CODE:
[Copy to clipboard]
<!--#include file="inc/inc.asp"-->
<!--#include file="admin/inc/md5.asp"-->
<%
dim rs,sql,username,password,ReturnUrl
username    = LCase(Replace(Trim(request("username")),"'",""))
password    = Replace(Trim(request("password")),"'","")
password    = MD5(password & "iloveyouhao0765")
ReturnUrl    = Trim(request("ReturnUrl"))

set rs      = Server.CreateObject("Adodb.recordset")
sql        = "select username,password,isVIP,lastLoginTime,lastLoginIP from BT_User where username='" & username & "'and password='" & password &"'"
rs.open sql,conn,1,3
If Not(rs.bof and rs.eof) Then
  If password = rs("password") Then
    session("username")  = rs("username")
    rs("lastLoginTime") = Now()
    rs("lastLoginIP")  = Userip()
    rs.update
    If rs("isVIP") = "VIP会员" Then
      session("isVIP") = True
    End If
    If Trim(request.cookies("p_Count")) = "" Then response.cookies("p_Count") = 0
    If ReturnUrl ="" Then  '登陆后返回URL
      Response.Redirect "eshop.asp"
    ElseIf ReturnUrl <> "" Then
      response.Redirect ReturnUrl
    End If
  End If
End If
rs.close
Set rs      = Nothing
Call closeConnection()

ErrMsg = ErrMsg & "<br/><li>用户名或密码错误！</li>"
ErrMsg = ErrMsg & "<br/><li>该用户不存在或已被锁定</li>"
ErrMsg = ErrMsg & "<br/><li><a href='Register.asp'>还没有注册？</a></li>"
Call WriteErrMsg2()
%>
看这里
If Not(rs.bof and rs.eof) Then
  If password = rs("password") Then
    session("username")  = rs("username")
    rs("lastLoginTime") = Now()
  如果我建个域名一样的网站，并知道了管理员的用户名，就可以伪造cookie欺骗了，哈哈