1) login.php is transmitting the password over regular HTTP. 

2)I'm still able to insert Javascript/Perl/PHP/SQL into your database

And you should be able to watch some of the things I'm doing right now... I'm giving your forms a workout.