Curious why would you update a password - when the fact is the client never had the "ability" to update it anyway ? Why not just skip the update and leave it alone..??

But I guess the main point here is when you do something like this Data Type and Field Length should be looked at closely.

Also of note - I have seen in more than one industry operator error is the "PHRASE of the DAY" and 95% of the time programmer error is really the issue, whether it be poor UI design or poor program design/coding.