Simple: Login error?

I use the DW Restrict Access behavior feature to create my login page. I hook it to a MS Access db, username and password table. (client required Access).

It works well, except when the viewer's last name is hyphenated (ex: Jones-Laurel), and then the login denies, when it shouldn't. I assume this has something to do with the server trying to subtract these names?

Here is the login code:

<cfset MM_redirectLoginSuccess="memberaccess/index2.cfm">
<cfset MM_redirectLoginFailed="login2.cfm?error=1">
<cfquery name="MM_rsUser" datasource="aptahpa">
SELECT id,last_name,levels FROM hpamembers WHERE id=
<cfqueryparam value="#FORM.username#">
AND last_name=
<cfqueryparam value="#FORM.password#" maxlength="255">
</cfquery>


What can I do to prevent this?

Many thanks,
Stephen