ASP Data Modification Save code

<!--#include file= "conn.asp"-->
<%
If session ("username") <> "admin" then
Response.Write "<script>alert (' You are not a system administrator, do not have this permission!") '); History.back () </script> "
Session ("passed") =false
Else
%>


<title> User Modification </title>

<body>
<%
Dim uid
Uid=request.querystring ("userid")
Sql= "SELECT * from Users where id=" & UID
' Define a Recordset object
Set Rs=server.createobject ("Adodb.recordset")
Rs.Open sql,conn,1,3
If Rs.eof Then
Response.Write ("Else
%>
<form method= "POST" action= "usersave.asp" Name=myform onsubmit= "return Chkfield ()" >
<p align= "center" > User basic information </p>
<br><br><br>
<center>
<table border= "0" width= "371" id= "table1" >
<tr>
&LT;TD bgcolor= "#c0c0c0" width= "align=" "Center" >
<font size= "2" > Username:</font>
</td>
&LT;TD width= ">"
<%=rs ("username")%>
<input Type=hidden Name=userid value=<%=rs ("id")%>>
</td>
</tr>
<tr>
&LT;TD bgcolor= "#c0c0c0" width= "align=" "Center" >
<font size= "2" > User name:</font>
</td>
&LT;TD width= ">"
<input type=text name=ename size=20 value= "<%=rs (" ename ")%>" >
</td>
</tr>
<tr>
&LT;TD bgcolor= "#c0c0c0" width= "align=" "Center" >
<font size= "2" > E-mail:</font>
</td>
&LT;TD width= ">"
<input type=text name=email size=20 value= "<%=rs" ("email")%> ">
</td>
</tr>
</table>
</center>
<p align= "center" >
<input type= "Submit" value= "submitted" Name= "B1" >
<input type= "reset" value= "reset" name= "B2" >
</p>
</form>
<%end if%>
</body>

<%
End If
%>

Working with files

<!--#include file= "chkpwd.asp"-->

<meta http-equiv= "Content-type" content= "text/html; charset=gb2312 ">
<title> User Management </title>

<body>
<%
UserID = Request.QueryString ("userid")
Oripwd = Request.Form ("Oripwd")
PWD = Request.Form ("pwd")
' Determine if this user exists
Set rs = Server.CreateObject ("Adodb.recordset")
' sql = ' select * from users where id = ' &userid& ' '
' Rs.Open sql,conn,1,1
Rs.Open "SELECT * from Users where id=" &userid,conn,1,3
If Rs.eof Then
Response.Write ("Response.Write ("<input type = button name = Close onclick = Window.close () value = off >")
ElseIf (RS ("Userpwd") <>md5 (ORIPWD)) Then
Response.Write ("Response.Write ("<input type = button name = Close onclick = Window.close () value = off >")
Else
sql = "Update users set userpwd= '" &md5 (Trim (pwd)) & "' WHERE id =" &userid
Set rs = Server.CreateObject ("Adodb.recordset")
Rs.Open sql,conn,1,3
Response.Write ("Response.Write ("<input type = button name = Close onclick = Window.close () value = off >")
End If
%>
</body>