Show error message for wrong password - asp.net

Question

I have this login code and I want to show (error message "Invalid User&Password") If someone input a wrong password, currently right now my code is just redirecting to same page if error occur.
[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult Login(Login l,string ReturnUrl="")
{
using (graceEntities dc = new graceEntities())
{
var user = dc.tbl_User.Where(a => a.UserName.Equals(l.Username) && a.Password.Equals(l.Password)).FirstOrDefault();
if (user != null)
{
FormsAuthentication.SetAuthCookie(user.UserName,l.RememberMe);
if (Url.IsLocalUrl(ReturnUrl))
{
return Redirect(ReturnUrl);
}
else
{
return RedirectToAction("Index","Main");
}
}
}
ModelState.Remove("Pasword");
return View();
}

Answer 1

You need to handle the case where the user is not found in the database. Please read the comments inline in code below for further clarification:
[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult Login(Login model, string ReturnUrl = "")
{
// 1. Do validation and return view if validation errors
if (!ModelState.IsValid)
{
return View(model);
}
// 2. No validation error so search db for user
using (graceEntities dc = new graceEntities())
{
var user = dc.tbl_User
.Where(a => a.UserName.Equals(model.Username) &&
a.Password.Equals(model.Password)).FirstOrDefault();
if (user != null)
{
FormsAuthentication.SetAuthCookie(user.UserName, model.RememberMe);
if (Url.IsLocalUrl(ReturnUrl))
{
return Redirect(ReturnUrl);
}
// No return url, redirect to main/index
return RedirectToAction("Index", "Main");
}
}
// 3. We made it here, so user was not found
ModelState.AddModelError("", "Invalid login attempt.");
return View(model);
}