title: PHP + No database: Login -> Will this be secure?
body: <p>I want to create a login for admin without database (it's a pretty simple site) here is my code, would this be secure or its easy to use my session? How can I make it better?</p>
  
  <p>index.php</p>
  
  <pre><code>&lt;?php
  include("auth.php");
  
  if(!checkAuthentication()){
  ?&gt;
  &lt;form method="post" action="?login=1"&gt;
      &lt;label for="username"&gt;Username&lt;/label&gt;
      &lt;input type="text" id="username" name="username"&gt;
      &lt;label for="password"&gt;Password&lt;/label&gt;
      &lt;input type="text" id="password" name="password"&gt;
      &lt;input type="submit" value="Login"&gt;
  &lt;/form&gt;
  &lt;?php
  }else{
  header("Location: protected_page.php");
  exit();
  }
  </code></pre>
  
  <p>functions.php</p>
  
  <pre><code>    &lt;?php
  session_start();
  
  // Check if username and password matches
  function authentication($username, $password){
      if($username == md5("admin") &amp;&amp; $password == md5("password")){
          return true;
      }else{
          return false;
      }
  }
  
  // Check if session data is still valid 
  function checkAuthentication(){
      if(isset($_SESSION['username']) &amp;&amp; isset($_SESSION['password'])){
          $result = authentication($_SESSION['username'], $_SESSION['password'], false);
      }else{
          $result = false;
      }
      return $result;
  }
  
  if(isset($_POST['username']) &amp;&amp; isset($_POST['password']) &amp;&amp; $_REQUEST['login'] == 1){
      $username = md5(htmlspecialchars($_POST['username']));
      $password = md5(htmlspecialchars($_POST['password']));
      if(!authentication($username, $password)){
          echo "Wrong Login.";
      }else{
          $_SESSION['username'] = $username;
          $_SESSION['password'] = $password;
          header("Location: http://localhost/login/protected_page.php");
          exit();
      }
  }
  ?&gt;
  </code></pre>
  
  <p>protected_page.php</p>
  
  <pre><code>&lt;?php
  include("auth.php");
  
  if(!checkAuthentication()){
      header("Location: http://localhost/login/index.php");
      exit();
  }
  
  var_dump($_SESSION);
  ?&gt;
  </code></pre>
  
  <p>Thanks for your kind help!</p>