there are a couple of different ways to protect files and folders depending on what web server you're running.
if you're running apache and need to protect a folder, use the .htaccess files to force the user to authenticate.
http://apache-server.com/tutorials/LPauth1.html
php can be used to protect individual files. take a look at the phpbuilder article that describes how.
http://www.phpbuilder.com/columns/tim20000505.php3