logic to block the unauthorized user

shah awan,
Did you get your answer?

The usual approach is to check if a user is logged in (based on a session variable) in the page load event. If not, redirect to a login page (or an error page in your case), else show the page.

In the login page, you can validate (as indicated by Shweta) and set a session variable to indicate that the user is valid; if the user is valid, you can redirect to the page where he/she came from.

shah awan,
You can execute your validation logic on your login form's button click. In case of invalid login details, you can redirect the user to error page.