PHP Authentication Security Can someone look over this?  This is the entire authentication file.  It's referenced at the beginning of all my catalog editing files to make sure only the specified user is logged in.  I want to make sure it's secure.

&lt;?php
//      pageauth.php
//      Asks for a username and a password and checks it.

if($_SESSION['logged_in'] != 1){
    if(!isset($_SERVER['PHP_AUTH_USER'])){
        header('WWW-Authenticate: Basic realm="Catalog Administration"');
        header('HTTP/1.0 401 Unauthorized');
        echo '&lt;h1&gt;Hey! You can\'t be here!&lt;/h1&gt;
        &lt;p&gt;Try logging in first!&lt;/p&gt;';
        exit;
    }elseif(md5($_SERVER['PHP_AUTH_USER']) != "04b2f0a4ad7772ca864aa569917b2d2d"){
        echo '&lt;h1&gt;Wrong Username!&lt;/h1&gt;
        &lt;p&gt;Only the admin username and password are accepted.&lt;/p&gt;';
    exit;
    }elseif(md5($_SERVER['PHP_AUTH_PW']) != "ed972411dfcca5313ab151694af01da8"){
        echo '&lt;h1&gt;Wrong Password!&lt;/h1&gt;
        &lt;p&gt;For obvious reasons, we need a correct password!&lt;/p&gt;';
        exit;
    }else{
        session_start();
        $_SESSION['logged_in'] = 1;
    }
}
?&gt;


I just need to authenticate for one user.  I don't need to go into databases or anything, so I thought PHP_AUTH would be a good solution.
md5 usage may be okay on small projects, but it's generally considered weak and shouldn't be used. As of the MD5 wikipedia page:


  The security of the MD5 hash function is severely compromised.


and http://us1.php.net/md5


  It is not recommended to use this function to secure passwords, due to the fast nature of this hashing algorithm.


So perhaps you should look into PHP's other hashing methods, say hash() itself. You can read more here: http://us1.php.net/manual/en/function.hash.php

Important Edit:

I read a little bit more and I am incorrect! The hash method is okay. It's not great like bcrypt! I highly suggest you read both of these and understand them, I'm sure it will come in handy later on! https://security.stackexchange.com/questions/17421/how-to-store-salt and https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords. And directly relating to PHP, http://us1.php.net/manual/en/function.password-hash.php