How do companies keep messing this up. The cardinal rule of web application security is to NEVER store plain text passwords anywhere. The only time your application should have access to plain text passwords is when it is hashing the password or verifying the password against a hash.

If you need to log all request data for some reason, strip the passwords out.

It really isn't difficult.