Yeah for a simple one, just use the .htaccess (google that) on the secret folder.
If you want the php solution, you need a login form which posts to a php file, which starts a session and lots of other stuff, and you have to be really careful about security (read the php security pages:
http://www.php.net/manual/en/security.php).
If you really want, the logon box and page can be in html, with a:
<form action='login.php' method=post>
then you can put all your security in 'login.php', and from there continue to the secure area.