If they have access to your server they can inline javascript that will do the same thing on the client. The client is not secure, ever. If the users are reusin

If they have access to your server they can inline javascript that will do the same thing on the client. The client is not secure, ever. If the users are reusing passwords, it's not something you can same them from except not saving the cleartext password yourself. Database attacks are different from on line interception.