The SQL Injection vulnerability, the fact that passwords are apparently stored in plain text in the DB, and passing the username and password in the querystring

The SQL Injection vulnerability, the fact that passwords are apparently stored in plain text in the DB, and passing the username and password in the querystring (which means they will get logged by IIS in plain text) are the biggest issues I see with this code. Bad bad bad.