Changing an expired password

[stmontgo]

query against dba_users for the account status and handle expired passwords
as part of the login.

I don't see any bind variables in your original code snippet leaving you open to
sql injection