asp-mssql-update - insert

<%
mPermission=Request.Form("permission")
Response.Write(mPermission)
mPassword=Request.Form("password")
Response.Write(mPassword)
User=Request.Form("User")
Response.Write(User)
Response.Write(User)
response.expires=-1
Set OBJdbConnection = Server.CreateObject("ADODB.Connection")
OBJdbConnection.ConnectionTimeout = Session("ConnectionTimeout")
OBJdbConnection.CommandTimeout = Session("CommandTimeout")
OBJdbConnection.Open Session("ConnectionString")
Set SQLStmt = Server.CreateObject("ADODB.Command")
Set RS = Server.CreateObject ("ADODB.Recordset")
q=ucase(User)
q=User
Response.Write(User)
if q<>"" then
SQLStmt.CommandText = "select * from users where userid='" & q &"'" 'asp-mssql-select
SQLStmt.CommandType = 1
Set SQLStmt.ActiveConnection = OBJdbConnection
RS.Open SQLStmt
Response.Write(User)
if not RS.EOF then
stat="update users set permission='"&mPermission&"',password='"&_
mPassword&"' where userid='" & q &"';"  'asp-mssql-update
else
stat="insert into users (userid,password,permission) values ('" &_
q & "','"&mPassword&"',"&"'"&mPermission&"');" asp-mssql-insert
end if
Response.Write(stat)
OBJdbConnection.Execute(stat)
end if
%>
<input type="button" value="Return" onClick="history.go(-1);return true;">