A couple of thoughts about this. You say you get an error; what is the message? Is it an invalid user? password? both? You have explicit checks for all three cases, so the error message will indicate what is not matching. You might want to put some debug (System.out.println) statments to make sure you're getting all of the value you think you should be getting from the database. If you have leading or trailing spaces on the values in the database, or in the values on the form, it could cause it to fail. It should be fairly easy to see what is happening and why the other values are failing. When you post code like this, if you put it inside CODE tags the formatting will be preserved and the code will be easier to read. You could edit your original post and put them in. I don't see where you are closing your ResultSet and Statement objects. Although this probably wouldn't cause the problem you're seeing, you MUST explicitly close the ResultSet and Statement objects after you are done with them. And that's best accomplished inside of the "finally" section of a "try/catch/finally" block.
Of course you want to handle closing the connection in a similar manner.