Recently a hacker posted a list of 5,000 websites online which were vulnerable to attack. ... For example, if you are looking for files stored on websites containing passwords, ...

Use a prompt and not an inline password field if you're not completely sure and don't defer its execution (that is, it shouldn't live to a point where events have access to it but only in sync code).