To do this without a db, you'll need to write the data into 'flat files' ... that is, a simple text file.
The text file will need to be writeable by the webserver, which is a bit of a security problem. It'd probably be best to have the file out from under the docroot.
For your coding, check out [man]fopen/man, [man]fwrite/man, [man]fread/man, etc.
Be sure and password protect the GUI; I'd use a session variable rather than a cookie. It sounds like you're in a shared environment (?) --- in that case, I'd also encrypt the password in the script. After your checking script receives the password, you can encrypt the attempt and compare the encrypted strings. (This is to avoid the issue of other users on the server doing directory traversals and reading the password(s) in your scripts directly.)
HTH,
