For a very simple databaseless website, I'm using an associative array to store logins like this:

```
$logins = array(
'user' => 'password',
'user2' => 'password2',
);

```

I check login attemps using this code:

```
$user = strtolower($_POST['username']);
$pass = $_POST['password'];
if(!isset($logins[$user]) or $logins[$user] != $pass){
    // failed login
}else{
    $_SESSION['username'] = $user;
}

```

What would the security vulnerabilities in this be?