Edit: This is not relevant to this particular question, but an advice on the subject in general.
It sounds like what you really want is a proper authentication mechanism. You should not try to roll your own, as it is considered bad practice. One secure and reliable authentication mechanism is HTTP Digest Access Authentication, which is deeply anchored in the HTTP framework. It is a challenge response protocol, meaning that something along these lines happen, when a user tries navigating to the "upload files" mechanism:
- User navigates to http://example.org/protected/upload.html
- Server notices that the /protected/ directory or the upload.html file is protected by Digest Authentication and responds with a 401 Authorization required error code. In it is a challenge for the user agent (the web browser) to respond to. The answer is calculated using the challenge, the user's credentials (username and password) along with some other information.
User enters password, leading to the user agent providing the server with an Authorization header, containing the response to the challenge
The server, using the credentials he has stored on the user, calculates the same response value using the same data that he sent the user.
The server compares the received and the locally generated response value, and if they are equal, grant access to the protected realm
All this is done using MD5 hashing as a standard. The application and servers can be configured to use MD5, SHA-X or any hashing algorithm - even iterated hashing, as long as the same procedure is followed on each side of the communication.
MD5 is considered broken, in the sense that it is fairly easy to find collisions. This is not a problem for this authentication process, as it requires a form of a preimage attack to successfully collect the password. This is only possible theoretically with a computational complexity of 2123.4.
If you are intimidated by this, or the scheme does not fit what you really need, at least store your password in a salted, hashed way, i.e. the database contains:
username | hash_function(password+":"+salt) | salt
Here, SHA-256 should be alright.
Please ask for more details on HTTP Digest Auth. if interested.
Also, consider adding your type of server application (Apache?) to the question.