You mention that a user has to be logged in to change their password, why not use their session key to look up the user_id in your .db file?

If I were to change the "hidden" value I could change someone elses password. Using the extra layer of abstraction (sess_id) makes this take substantially more difficult.

I have never used the DBI for text files, however there is a csv driver that looks like it would do exactly what youre after. It would mean a bit of work, but you'd be able to update only the fields you want to.

There is also the advantage of making your app more portable, and flexible. For example if one day you're able to use an RBDMS there shouldnt be too much you'll need to change in your code.