in HTML if you have <input type="password"> instead of <input type="text">, you can be assured that those asterisks come instead of text when typing.
for security:
when the user submits the form using javascript, read the value of the password, encrypt it using an implementation of MD5 in javascript and submit only the encrypted password and not the real one to the form.
when u store the password in the database, dont store the password directly, encrypt it using MD5 and store that value.
compare the encrypted password sent and encrypted password stored.
NOTE: this is only a simple one and lot of enhancement can (read "should") be done to create a securer system.
also note, you will not be able to tell the user his old password incase he forgets that, so you will have to give him an option to set a new password instead of telling him his old password.
