you could use apache to auth the users. in your apache password file (mine is /home/httpd/.htpasswd) just have ":encrypted_password" and in .htaccess file in the folder to be protected:
##############################
AuthName "Protected"
AuthType Basic
AuthUserFile /home/httpd/.htpasswd
require valid-user
##############################
apache will prompt for username/password on accessing the folder or any file inside it, user leaves username blank and types in the password to connect.
if you rely on php to auth users one of the issues is that you need to protect each and every file in the folder (add a generic header to each script and check sessions to be sure the user is logged in). or you can place your content into a database (mysql perferred =) ) and have a php script to verify password and pull the correct file from the database.