what I used to do is that i will provide a special login form for my member. Username and password are required.
They have been previously stored in my database, of course.
Upon the successful of login process (both username and password are valid), I'll set a cookie which contains the username and encrypted form of username+password.
In the beginning of each page in member area, I'll have a script to check whether or not a user has logged in.
If yes, then let them in. Otherwise, send them an error message.
One related article to this can be found at
webmasterbase.com