title: Passwords with simple if statement
body: <p>I apologize if this is a duplicate, I tried searching for this and haven't found exactly what I'm looking for.</p>
  
  <p>Ok so let's say I have a code like this</p>
  
  <pre><code>&lt;?php 
  $user = $_POST['username'];
  $pass = $_POST['password'];
  
  if ($user == "admin" &amp;&amp; $pass == "password")
  {
     echo "Password correct";
  }
  
  else
  {
     echo "Password incorrect";
  }
  ?&gt;
  </code></pre>
  
  <p>How effective would this method of username/password validation be?
  I know it's not the best way to do this but why not? How exactly could someone hack this?</p>
  
  <p>I've seen some example's like this</p>
  
  <pre><code>&lt;?php 
  $user = $_POST['username'];
  $pass = $_POST['password'];
  
  if ($user == "admin" &amp;&amp; $pass == "password")
  {
     include "correct.html";
  }
  
  else
  {
     echo "Password incorrect";
  }
  ?&gt;
  </code></pre>
  
  <p>But I know that would be worse since someone could just directly access the "correct.html" file and bypass the initial security check.  However by using <code>echo</code> would they be able to go around the username/password check?</p>