I am writing a script and was wondering if I used this code would the page be unaccessable to unauthorized visitors.

It uses two sign in pages
the first page(signin.php) is a form requesting name and password The action is set to a different page(allow.php) and then a secure page(securepage.php) in a subfolder called Admin

signin.php

<form action="allow.php" method="post">
<input type="hidden"  value" 62">
<input type="text" value="Name is" name="name">
<input type="password" value="password is" name="pass">
</form>
end sigin.php

File=allow.php

PHP Code:

if($_POST==62){
RUN SQL STATEMENT}
if (the user is in db records){ echo'<meta http-equiv="refresh" content="5;http://mysite.com/Admin/securepage.php">';
}else{
echo 'Invalid sign-in <a href="signin.php">here</a>';
}else{//this section code should be executed if my form wasn't filled out previously
echo 'Please sign in <a href="signin.php"> Here</a>';}
end allow.php 


file=secure.php

PHP Code:

<?php
$page='http://mysite.com/allow.php';
if($_SERVER['HTTP_REFERRER'] != $page)
{echo '<meta http-equiv="refresh' content="1;http://mysite.com">';
}else{load requested page}

then on every other page in my admin folder

$page='http://mysite.com/Admin/*'; 
if($_SERVER['HTTP_REFERRER'] != $page)
{echo '<meta http-equiv="refresh' content="1;http://mysite.com">;
}else{load requested page}

?>

The obvious problem i see is the use of the referrer to check where people have come from.
It causes two problems, the referrer can be fake easily, and some security software prevent peoples browsers from sending the referrer.
So some people who are allowed to view the page will be prevented from seeing it because thier browser hasnt sent the referrer.

somthing simple would be just to have a form post to a php page and then do...

PHP Code:

<?php

$posted_pass = $_POST['password'];

if($posted_pass == "a-password";
{
echo "Contents of the page";
}
else
{
echo "Wrong password fool";
}
?>

hmmm... the part that stands out to me is there is no checking for special characters such as ' " + ; that can be used to attack your database, all posted data should be thoroughly checked before going into the database