private Element login(HttpServletRequest request, Element elResult) {
		HttpSession session = request.getSession(true);

		Element elResponse = new Element ("response");
		String username = request.getParameter("username");
		String password = request.getParameter("password");
		
		if (username == null || "".equals(username)) {
			elResponse.setAttribute("success", "0");
			elResponse.setAttribute("errmsg", "Username shouldn't be blank.");
			elResult.addContent(elResponse);
			return elResult;
		}
		if (password == null || "".equals(password)) {
			elResponse.setAttribute("success", "0");
			elResponse.setAttribute("errmsg", "Password shouldn't be blank.");
			elResult.addContent(elResponse);
			return elResult;
		}
		SqlConn con = null;
		String sql = "";
		ResultSet rs = null;
		try {
			con = ConnFactory.getConnection("license");
			sql = "select username, id from user where username = '" + username + "' and password = password('" + password + "')";
			logger.info("sql is " + sql);
			rs = con.query(sql);
			if (rs != null && rs.next() && rs.getInt("id") > 0) {
				session.setAttribute("username", username);
				session.setAttribute("user_id", rs.getString("id"));
				elResponse.setAttribute("success", "1");
			} else {
				elResponse.setAttribute("success", "0");
				elResponse.setAttribute("errmsg", "The username/password doesn't match any record in our database.");
			}
		} catch (Exception e) {
			elResponse.setAttribute("errmsg", "login failed: " + e.getMessage());
			elResponse.setAttribute("success", "0");
			logger.error(e.getMessage());
		} finally {
			con.close();
		}
		elResult.addContent(elResponse);
		return elResult;
	}