Login

Perhaps have a login page that asks the user for his username and password. And whatever page that posts to (which could be the same page for a self posting form) tests these fields against what is in the database, sets the username and userlevel session variables accordingly, and then redirects to the proper page - i.e. back to the login page if the password is wrong (perhaps with a JavaScript popup saying wrong username/password combination) or to the main menu page if the password is correct:

Session("UserName") = objRS("UserName")
Session("UserLevel") = objRS("UserLevel")
Response.Redirect "mainmenu.asp"

Then you can use If Then's or Select Case on each page to control whether a user is allowed to actually be there and whether particular links of where a user can go actually show up.

If (Session("UserLevel") <> "Admin") And (Session("UserLevel") <> "Regular") Then
Response.Redirect "login.asp"
End If

Best regards,
J. Paul Schmidt
www.Bullschmidt.com - Freelance ASP Web Developer
www.Bullschmidt.com/DevTip.asp - ASP Web Developer Tips