Restricted List base on login

In my Login page event (After successful login)
Session("First_Name")=data("First_Name")

Session("Last_Name")=data("Last_Name")

Session("School_Code")=data("School_Code")

Session("SchoolList")=data("SchoolList")

Session("Group")=data("Group")

Session("UserID")=data("UserID")

Session("Email")=data("Email")
Each of these fields are from my "Security" table. I have a field in security called "Group" and have 2 different groups. SCHL states the user should only have access to one school. SPCL states the user has access to multiple schools. In my example, I only want the user to see the students that are enrolled at the users school for SCHL or multiple schools for SPCL. I have a table of ALL students called "StuSchool" and "PMSCHL" is the field in the StuSchool table that lists the school #/code. Security field "School_Code" has one school #. Security field "SchoolList" has a list of school numbers.
In the table I wish to filter the results, I place the following in the List Page - List page: Before SQL Query event:
if Session("Group")="SCHL" then

str = "select School_Code from Security where UserID='" & Session("UserID") & "'"

Set rstmp = server.CreateObject("ADODB.Recordset")

rstmp.open str,dbConnection

strWhereClause = whereAdd(strWhereClause,"StuSchool.PMSCHL='" & rstmp("School_Code") & "'")

rstmp.close

end if
if Session("Group")="SPCL" then
str = "select SchoolList from Security where UserID='" & Session("UserID") & "'"

Set rstmp = server.CreateObject("ADODB.Recordset")

rstmp.open str,dbConnection

strWhereClause = whereAdd(strWhereClause,rstmp("SchoolList"))

rstmp.close

end if

Just an idea!
Use/make a table called: SchoolsPerUser
In this table register the schools a user has access to.
...then the students per school can be shown or not (relationship etc)
Regards,
Ruud Wiering