Login Form With SESSION Without Connect To Database

<?

        $username = "xsecurity"; # Here Your Username
        $password = "e10adc3949ba59abbe56e057f20f883e"; # password = 123456
        $user = $_POST['user'];
        $pass = $_POST['pass'];
        $form = "<form method='POST'>
        <center>
        Login Form ! <br>
        <input type='text' name='user'>
        <input type='password' name='pass'>
        <input type='submit' value='Login !'>
        </form>";

        session_start();
        if(!isset($_SESSION['sec']))
        {
                $_SESSION['sec'] = false;
        }
        if(isset($pass))
        {
                if($user == $username and md5($pass) == $password)
                {
                        $_SESSION['sec'] = true;
                }
                else
                {
                        die("{$form} <br> Wrong Password :D");
                }
        }
        if(!$_SESSION['sec']):
        echo $form;
        exit();
        endif;

        # Logout
        if($_GET['log'] == 'out')
        {
                session_destroy();
        }
        echo "Welcome {$user} | <a href='?log=out'>Logout</a>";
?>