The MVC standard has three layers
-
View : Your views are the ways data is presented to the user. In short it would be an html, flash, air, or whatever interface type it will adopt. In the view you should not have any business rules other than simple command blocks such as
for
or foreach
to display a list of records.
-
Controller : The controller will handle the communication between the view and the model. Here you will process data received from the request, send to model methods, and pass and display the appropriate view. Here you can also have watermarks like email sending, permission validation, etc.
-
Model : The model must have its entire business rule related to the database. Whatever the query or manipulation of data should stay in.
To be more specific with your question, the form would be in the view, the controller will receive the data, and save sessions and cookies, and to consult the data in the database you will use their models.
Tips
There are some layers that can be added that increase the possibility of reuse of code as a layer called service, which would be a layer where would be rules not related to the data, but very important.
In the service layer it could contain a class called Autenticação
for example with methods that can check if a user is logged, because it uses the session or cookie and not the database, or even for the registry of users that besides register in the database using the model, you should send a confirmation email.
Using a service layer allows multiple rules to be reused on all controllers.
You can find more information about MVC right here on Stack Overflow as well as tips for creating secure authentication systems .