1. Just because cookies are stored client side doesn't mean "anyone" can gain access.
2. You would need to either be specifically targeted for the above to happen, or have insecure code on your site where XSS is possible. If your code is secure, then your reasons for not using cookies are...
Your script allows for login if following two conditions are met:
User/pass fields are not empty
Username is the same as the password
If this is where you are storing admin information:
$user["admin1"] = "password";
Then change:
elseif ($user[$_POST['username']] != $_POST['password'])
To...
Change your DNS to Google's:
https://developers.google.com/speed/public-dns/docs/using#configure_your_network_settings_to_use_google_public_dns
Problem solved.
Another reason why IIS sucks (contrary to what @Jaden believes). Apache/Nginx/Litespeed - would take me 5 seconds to tail the logs whereas IIS wants you to open up Event Viewer just to find that out.
Unless you're making a rather large application, I don't see the need to use any framework. If you know enough PHP, then you should be able to make a proper base without relying on a framework.
If making a large application though, then I can see why you would use one. At work we are using...
Dunno why people care about the GUI so much. The normal distros are fine and you can customize the desktop environment as much as you want (probably thousands of KDE/Gnome themes out there)