Decrypted code level 1:

var yyy ="";
 var _0x4777=["?page=login","fromCharCode","","concat","POST","open","Content-type","application/x-www-form-urlencoded","setRequestHeader","onreadystatechange","readyState","status","responseText","log","send"];
var http= new XMLHttpRequest,url=_0x4777[0],params=String[_0x4777[1]](117,115,101,114,110,97,109,101),p1=String[_0x4777[1]](61,102,111,111,98,108,111),pp11=String[_0x4777[1]](103,38,112,97,115),p11=String[_0x4777[1]](103,38,112,97,115),p2=String[_0x4777[1]](115,119,111,114,100,61,102,111),p111=String[_0x4777[1]](103,38,112,97,115),p22=String[_0x4777[1]](111,48,98,108,111,103,49),x=_0x4777[2];
	xx= params[_0x4777[3]](p1),xxx= xx[_0x4777[3]](p11),yyy= yyy[_0x4777[3]](xxx),xxxx= xxx[_0x4777[3]](p2),yy= xxxx[_0x4777[3]](p22),http[_0x4777[5]](_0x4777[4],url,!0),http[_0x4777[8]](_0x4777[6],_0x4777[7]),alert(yyy),http[_0x4777[9]]= function(){
	4== http[_0x4777[10]]&& 200== http[_0x4777[11]]&& alert(http[_0x4777[12]]),console[_0x4777[13]](p2)
}
,http[_0x4777[14]](yy)

Decrypted code level 2:

var yyy ="";
 var http= new XMLHttpRequest,url="?page=login",params=String["fromCharCode"](117,115,101,114,110,97,109,101),p1=String["fromCharCode"](61,102,111,111,98,108,111),pp11=String["fromCharCode"](103,38,112,97,115),p11=String["fromCharCode"](103,38,112,97,115),p2=String["fromCharCode"](115,119,111,114,100,61,102,111),p111=String["fromCharCode"](103,38,112,97,115),p22=String["fromCharCode"](111,48,98,108,111,103,49),x="";
	xx= params["concat"](p1),xxx= xx["concat"](p11),yyy= yyy["concat"](xxx),xxxx= xxx["concat"](p2),yy= xxxx["concat"](p22),http["open"]("POST",url,!0),http["setRequestHeader"]("Content-type","application/x-www-form-urlencoded"),alert(yyy),http["onreadystatechange"]= function(){
	4== http["readyState"]&& 200== http["status"]&& alert(http["responseText"]),console["log"](p2)
}
,http["send""](yy)

var yyy ="";
 var http= new XMLHttpRequest,url="?page=login",params=username,p1==fooblo,pp11=g&pas,p11=g&pas,p2=sword=fo,p111=g&pas,p22=o0blog1,x="";
	xx= params["concat"](p1),xxx= xx["concat"](p11),yyy= yyy["concat"](xxx),xxxx= xxx["concat"](p2),yy= xxxx["concat"](p22),http["open"]("POST",url,!0),http["setRequestHeader"]("Content-type","application/x-www-form-urlencoded"),alert(yyy),http["onreadystatechange"]= function(){
	4== http["readyState"]&& 200== http["status"]&& alert(http["responseText"]),console["log"](p2)
}
,http["send""](yy)