sql = "select * from [user] where name='" &replace(name,''','')& "' and password = '" & replace(password,''','') & "'"