don't forget to validate the passwords.
<!--- set Error message --->
<cfset errorMsg = "">
<!--- get old password --->
<cfquery name = "qGetOldPassword" datasource = "myDSN">
SELECT password FROM usersTable WHERE userName = "session.userName"
</cfquery>
<!--- check old passwords --->
<cfif qGetOldPassword.password neq form.password>
<cfset errorMsg = "Your old password did not match your current password<br>">
</cfif>
<!--- check to make sure the new passwords matched --->
<cfif form.password neq form.validatePassword>
<cfset errorMsg = errorMsg & "Your new passwords did not match<br>">
</cfif>
<!--- make update if no errors were found --->
<cfif errorMsg eq "">
<cfquery datasource = "myDSN">
UPDATE usersTable SET password = '#form.password#'
</cfquery>
</cfif>
this is easiest done if the page with the form submits to itsself. that way you don't have to worry about passing "errorMsg" back to the form page to present the user with the error...in my opinion anyway.