When the form is submitted, you can do a query into the database for when username is the currently logged in username and the password. Then you could check if the recordset is empty or not. If the recordset is empty, then you would display a validation error. If the recordset is not empty, that means the password matched up and you can continue with the update.