How to create a correct login form ?

Model
---
 public class Login
    {


        int _UserID;
        public int UserID
        {
            get { return _UserID; }
            set { _UserID = value; }
        }

        int _UserRole;
        public int UserRole
        {
            get { return _UserRole; }
            set { _UserRole = value; }
        }
        string _UserName;
        public string UserName
        {
            get { return _UserName; }
            set { _UserName = value; }
        }

         string _LoginId;
        public string LoginId
        {
            get { return _LoginId; }
            set { _LoginId = value; }
        }

        string _UserEmail;
        public string UserEmail
        {
            get { return _UserEmail; }
            set { _UserEmail = value; }
        }

    }


view---

  <div id="form_wrapper" class="form_wrapper">
                <form class="login active" action="">
                <h3>
                    RTI Web App Log In</h3>
                <div>
                    <label>
                        Username:</label>
                    <input id="username" value="cr2" type="text" />
                    <span class="error">This is an error</span>
                </div>
                <div>
                   <label>Password: <a href="#" rel="forgot_password" class="forgot linkform">Forgot your password?</a></label>
                    <input id="password" value="123456" type="password" />
                    <span class="error">This is an error</span>
                </div>
                <div class="bottom">

                    <input type="submit" value="Login"  onclick="VarifyUser();" />
                    <div class="clear">
                    </div>
                </div>
                </form>
                <form class="forgot_password">
                        <h3>Forgot Password</h3>
                        <div>
                            <label>Username or Email:</label>
                            <input type="text" />
                            <span class="error">This is an error</span>
                        </div>
                        <div class="bottom">
                            <input type="submit" value="Send reminder"></input>
                            <a href="/User/LogOn" rel="login" class="linkform">Suddenly remebered? Log in here</a>
                            <%--<a href="register.html" rel="register" class="linkform">You don't have an account? Register here</a>--%>
                            <div class="clear"></div>
                        </div>
                    </form>
            </div>


--------

script for view

<script type="text/javascript">
    function VarifyUser() {
        var Id = document.getElementById('username').value;
        var Password = document.getElementById('password').value;
        $.ajax({
            url: "/Login/VarifyUser",
            type: "POST",
            data: { Id: Id, Password: Password },
            datatype: "html",
            success: function(data) {
            if (data == "success") {
                    window.location = '/Home/Index';
                }
                else {
                    alert(data);
                    return false;
                }
            }
        });
    }
</script>

------

Controller

 public ActionResult Index()
        {
            return View();
        }

public string VarifyUser(string Id, string Password)
        {
            if (Id.ToLower().Contains("select") && Id.ToLower().Contains("from") || Id.ToLower().Contains("delete") && Id.ToLower().Contains("from"))
            {
                return "Please Don't Try to Hack this Site";
            }
            else
            {
                try
                {
                    cu.Loginname = Id;
                    cu.Password = Password;
                    CompositeUser Userdata = sc.GetUserDataContract(cu);
                   // if (Userdata.Returnvalue == 1)
                  //  {
                        //foreach( var User in Userdata)
                        //{
                            if (Userdata.Active == 'N')
                            {
                                return "Your Account Has Been Closed !! Please Contact You Administrator";
                            }
                            else if (Userdata.Active == 0)
                            {
                                return "Wrong Password or UserId";
                            }
                            else
                            {

                                Login LoginUser = new Login()
                                {
                                    UserID = Userdata.Id,//data.User_id,
                                    LoginId = Userdata.Loginname, //data.User_name,
                                    UserName = Userdata.Firstname + " " + Userdata.Lastname, //data.User_firstname + " " + data.User_firstname,
                                    UserRole = Userdata.Role, //data.User_role,
                                    UserEmail = Userdata.Email// data.User_email
                                };

                                Session["UserID"] = Userdata.Id;
                                Session["LoginId"] = Userdata.Loginname;
                                Session["UserName"] = Userdata.Firstname + " " + Userdata.Lastname;
                                Session["UserRole"] = Userdata.Role;
                                Session["UserEmail"] = Userdata.Email;

                                return "success";
                                //   }
                                // }
                                // else
                                //   {
                                //     return "Invalid User";
                                //  }
                            }
                }
                catch
                {
                    return "Error Occured !! Please Try By Refreshing The Page";
                }

            }

        }
--------