I agree that weak passwords are very likely for family photo galleries -- even for me as a security-minded person. But, it is not much more work to generate and then store a secure hash than a plain text password, and even though rainbow tables will conquer weak passwords, if any of your customers care to use good passwords, they can have high confidence in the security of their perhaps more sensitive images. A simple mistake (or malicious act) in server administration or a .htacess file can result in a php file being sent out as plain text instead of causing it to be processed by the php module on the web server. This is why it is better to use a secure digest or a file outside of docroot instead of plaintext embedded in a php file. Since your customers typically will not be able to utilize a file outside of docroot, the hash is the most secure option remaining.