<p>I have a PHP script that runs as a CGI program and the HTTP <code>Authenticate</code> header gets eaten and spit out. So I would like to implement some kind of FORM based authentication. As an added constraint, there is no database so no session data can be stored.</p>

<p>I am very open to having a master username and password. I just need to protect the application from an intruder who doesn't know these credentials.</p>

<p>So how would you implement this?</p>

<p>Cookies?</p>

<p>I could present the form and if it validates, I can send back a cookie that is a hash of the IP address come secret code. Then I can prevent pages from rendering unless the thing decrypts correctly. But I have no idea how to implement that in PHP.</p>

A few ways you could do this.
htaccess
-- have your webserver handle securing the pages in question (not exactly cgi form based though).
Use cookies and some sort of hashing algorithm (md5 is good enough) to store the passwords in a flat file where each line in the file is username:passwordhash.  Make sure to
salt
your hashes for extra security vs rainbow tables. (This method is a bit naive... be
very
careful with security if you go this route)
use something like a
sqlite
database just to handle authentication.  Sqlite is compact and simple enough that it may still meet your needs even if you don't want a big db backend.
Theoretically, you could also store session data in a flat file, even if you can't have a database.