title: sha256 with PHP session
body: <p>New to security and wondering how secure this type of login is?  I am not protecting any bank/financial data by any means but trying to secure somewhat sensitive data that shouldn't be exposed to the general public.  I only require a password - no official logins are done.</p>
  
  <p>This is in a file called access.php which houses a password input field.</p>
  
  <pre><code>&lt;?php
  session_start();
  if (!isset($_SESSION['loggedIn'])) {
      $_SESSION['loggedIn'] = false;
  }
  
  // sha256() password 
  $password = '13d249f2cb4127b40cfa757866850278793f814ded3c587fe5889e889a7a9f6c';
  
  if (isset($_POST['password'])) {
      if (hash('sha256',$_POST['password']) == $password) {
          $_SESSION['loggedIn'] = true;
      } else {
          die ('That is the incorrect password - Please leave now');
      }
  } 
  
  if (!$_SESSION['loggedIn']):
  ?&gt;
  </code></pre>
  
  <p>Then my index.php requires access.php at page load.  Should access live outside the public directory?  Am I missing anything else I should be considering?</p>