most likely the php install where you are running it is installed as a cgi, not an apache module. if thats the case, there is nothing that can be done to that script to make it work, you will have to come up with another method to protect pages.
or if register_globals is turned off in your php.ini and php IS running as an apache module, you may want to try $SERVER['PHP_AUTH_USER'], $SERVER['PHP_AUTH_PW'] instead of what is there