the only real secure way to handle password protection is with a scripted page which starts by asking the user for two matching tokens (like a username and password). From there you normally set the "session id" which is a unique 32character hex string. This is set on the user's machine, and as long as he carries it from page to page or by cookie, he is logged in so to speak. No other person would have that session ID. However you need to analyze it on the server side.
If you're just starting out I recommend you look at session variables in PHP. You'll start to work with some things and people will then give you more specific answers in the course of developing your ap.
one more thing - you can't make test.txt secure obviously, but you can put outside of the directory root and then get it like this:
<?php $string=implode('', file('/private/path/myfile.txt')); ?>
Samuel
