my $query = "UPDATE staff 
            SET password=".$dbh->quote($FORM{'newpassword'}.
            " WHERE ".$dbh->quote($FORM{'name'}).
            " =". $dbh->quote($record{'login'});