adding a second session variable but not successfully to pull correct recordset

Hi,

I have a User Login app where I want the current page to refresh with "Invalid Login" if it is incorrect, or if it's successful, I want the login to disappear and the page to refresh with a "Welcome UserName" in that corner.

I have everything functioning, except it only ever pulls the first record from the DB - not the correctly logged-in user.

I'm creating two session variables - MM_UserName and MM_UserID and using UserID to pull the relevant user record and all fields of their data, but this is the piece that isn't working. Does anyone know why this isn't grabbing the correct record? I have a few IF statements here and there to make the form disappear and I suspect that's part of the issue, but all of that appears to function normally, other than not grabbing the right record. Here is the relevant code:

<%if (cStr(Request("success"))<>"") then %>

<%
Dim User__MMColParam
User__MMColParam = "1"
If (Session("MM_UserID") <> "") Then
  User__MMColParam = Session("MM_UserID")
End If
%>
<%
Dim User
Dim User_cmd
Dim User_numRows

Set User_cmd = Server.CreateObject ("ADODB.Command")
User_cmd.ActiveConnection = MM_TotalBodyTracker_STRING
User_cmd.CommandText = "SELECT * FROM Users WHERE UserID = ?"
User_cmd.Prepared = true
User_cmd.Parameters.Append User_cmd.CreateParameter("param1", 5, 1, -1, User__MMColParam) ' adDouble

Set User = User_cmd.Execute
User_numRows = 0
%>

<% Else %>

<%
' *** Validate request to log in to this site.
MM_LoginAction = Request.ServerVariables("URL")
If Request.QueryString <> "" Then MM_LoginAction = MM_LoginAction + "?" + Server.HTMLEncode(Request.QueryString)
MM_valUsername = CStr(Request.Form("UserName"))
If MM_valUsername <> "" Then
  Dim MM_fldUserAuthorization
  Dim MM_redirectLoginSuccess
  Dim MM_redirectLoginFailed
  Dim MM_loginSQL
  Dim MM_rsUser
  Dim MM_rsUser_cmd
 
  MM_fldUserAuthorization = "UserAccessLevel"
  MM_redirectLoginSuccess = "index.asp?success=true"
  MM_redirectLoginFailed = "index.asp?failed=true"

  MM_loginSQL = "SELECT UserName, UserPassword, UserID"
  If MM_fldUserAuthorization <> "" Then MM_loginSQL = MM_loginSQL & "," & MM_fldUserAuthorization
  MM_loginSQL = MM_loginSQL & " FROM Users WHERE UserName = ? AND UserPassword = ?"
  Set MM_rsUser_cmd = Server.CreateObject ("ADODB.Command")
  MM_rsUser_cmd.ActiveConnection = MM_TotalBodyTracker_STRING
  MM_rsUser_cmd.CommandText = MM_loginSQL
  MM_rsUser_cmd.Parameters.Append MM_rsUser_cmd.CreateParameter("param1", 200, 1, 255, MM_valUsername) ' adVarChar
  MM_rsUser_cmd.Parameters.Append MM_rsUser_cmd.CreateParameter("param2", 200, 1, 255, Request.Form("UserPassword")) ' adVarChar
  MM_rsUser_cmd.Prepared = true
  Set MM_rsUser = MM_rsUser_cmd.Execute

  If Not MM_rsUser.EOF Or Not MM_rsUser.BOF Then
    ' username and password match - this is a valid user
    Session("MM_Username") = MM_valUsername
      Session("MM_UserID") = MM_valUserID
    If (MM_fldUserAuthorization <> "") Then
      Session("MM_UserAuthorization") = CStr(MM_rsUser.Fields.Item(MM_fldUserAuthorization).Value)
    Else
      Session("MM_UserAuthorization") = ""
    End If
    if CStr(Request.QueryString("accessdenied")) <> "" And false Then
      MM_redirectLoginSuccess = Request.QueryString("accessdenied")
    End If
    MM_rsUser.Close
    Response.Redirect(MM_redirectLoginSuccess)
  End If
  MM_rsUser.Close
  Response.Redirect(MM_redirectLoginFailed)
End If
%>


<% End If %>


Any ideas?

Thank you

Bill