I find the text file approach works fine for small sites. To keep the login credentials secure you'll want to encrypt them, as pritaeas mentioned.
If you're unfamiliar with secure hashing algorithms, you might find this a useful resource: Salted Password Hashing - Doing it Right. The article includes code for PHP and other languages.
Web servers are generally configured to serve text files, so it's probably a good idea to keep the file outside your web publishing directory.