PHP login based on a password parameter I'm learning PHP now, and I'm trying to find out whether or not the following code structure has any faults:

$loggedIn = false;
if (isset($_GET["userpass"])){
    if (strcmp($_GET["userpass"], $correctPassword) == 0) {
        $loggedIn = true;
    }
}


To me, it seems pretty bullet-proof. If the password isn't set, then the code doesn't execute. And if it is, then the user actually has to supply the correct password. Anything obvious I'm missing?

Note:
$correctPassword is defined in an external file, not accesible to the public

Update:
Can the user of this website explit the script so that he can log in to any arbitrary account? As in, this piece of code always sets $loggedIn = true;
This is not secure at all. 

Apart from the GET issue (use POST) and the hashing issue (use bcrypt) already mentioned, and the fact that == is not timing safe (use hash_equals), an attacker can log in without knowing the password like this:

login.php?userpass[]=1


The reason for this is that strcmp("STRING", [ARRAY]) returns NULL, and NULL == 0 is true. You should pretty much never use ==. Always use === for type-safe checks.