You are not checking whether any of the records contain the user's name. You are also comparing the variable user to a hard coded string "rs" therefore the only time the code will work is when the name is "rs".
Assuming the database table 'system' has a field 'user' which contains the user's name here is what I would do:
Code:
...
ssql = "SELECT user FROM system WHERE user = '" & user & "'"
Set rs = cn.Execute(ssql)
If Not rs.EOF Then
Response.Redirect("trip.asp")
Else
Response.Redirect("signin.asp")
End If
%>
You really need to think about how you are coding, this is a very simple problem that can be solved by using common sense.
The variable rs is a recordset which contains records, "rs" is a string that will always have a value of "rs" and unless you actually look for the row in your recordset instead of just looping through them all you will never find the correct row.
Hardly an ASP Pro Code question, more of a 'can someone teach me how to program' question.
Regards
Owain Williams