How do websites (such as this one) handle log-ins? The only way I know is to take the username and password using an HTML form and use PHP to check it against a database and if it matches creates a session. In every page that requires a user to be logged in have
<?php
if($_SESSION['loggedIn'] != 'true')
header( 'Location: login.html' );
?>
<HTML>
...
But according to this page <input type="password"> is transferred in clear text so anything using HTML’s input is bad. According to the JavaScript Kit all JavaScript password scripts are insecure. What can one use?
The simple scenario you outline above is about how it usually works.
<input type="password">is by default sent to the server in plain text, which is why login pages should use HTTPS to encrypt that communication. JavaScript has nothing to do with this.