ASP.NET

strSQL = "SELECT SubCategory, COUNT(*) AS myCount "_
	& "FROM Products " _
	& "WHERE SubCategory LIKE '%"  & Replace(strSearch, "'", "''") & "%' " _
        & "GROUP BY Subcategory " _
        & "Order BY Subcategory ;"

(SubCategory LIKE @SubCategory + '%')

public ActionResult Authenticate(string username, string password, string rememberMe)
        {
            var user = userRepository.GetUserByName(username);

            if (user != null && user.password.Trim() == password)
            {
                SetAuthenticationCookie(username);
                
                FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
                    1, // Ticket version
                    username,// Username to be associated with this ticket
                    DateTime.Now, // Date/time ticket was issued
                    DateTime.Now.AddMinutes(50), // Date and time the cookie will expire
                    true, // if user has chcked rememebr me then create persistent cookie
                    roles, // store the user data, in this case roles of the user
                    FormsAuthentication.FormsCookiePath); // Cookie path specified in the web.config file in <Forms> tag if any.// To give more security it is suggested to hash it
                string hashCookies = FormsAuthentication.Encrypt(ticket);
                HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, hashCookies); // Hashed ticket// Add the cookie to the response, user browser
                Response.Cookies.Add(cookie);
                return RedirectToAction("index", "Home");
            }
            else
            {
                // If we got here then something is wrong with the supplied username/password
                return View("Register");
            }
        }

        [Authorize(Roles = "admin")]
        public ActionResult Test()
        {
            return View("chat");
        }

protected void Application_AuthenticateRequest(object sender, EventArgs e){
            // look if any security information exists for this request
            if (HttpContext.Current.User != null){
                // see if this user is authenticated, any authenticated cookie (ticket) exists for this user
                if (HttpContext.Current.User.Identity.IsAuthenticated){// see if the authentication is done using FormsAuthentication
                    if (HttpContext.Current.User.Identity is FormsIdentity){// Get the roles stored for this request from the ticket// get the identity of the user
                        FormsIdentity identity = (FormsIdentity)
                        HttpContext.Current.User.Identity;// get the forms authetication ticket of the user
                        FormsAuthenticationTicket ticket = identity.Ticket;// get the roles stored as UserData into the ticket 
                        string[] roles = ticket.UserData.Split(',');// create generic principal and assign it to the current request
                        HttpContext.Current.User = new System.Security.Principal.GenericPrincipal(identity, roles); }
                }
            }
        }