Hi,
I create a procedure like
create procedure xyz.ch_pass
(usr in varchar2,
pass in varchar2,
oldpass in varchar2)
begin
execute immediate 'alter user '||usr||' identified by '||pass||' replace '||oldpass;
end;
User xyz has alter user privs. When I grant execute this procedure to different users. They are able to change their and other user password. I want they be able to chang their own password only. How I do that....

One thing more please.
I have username like 1234/4321 OR abcd/dcba etc..
Now
When I use
execute immediate 'alter user '||user||' identified by '||pass;
it works for character user i.e. abcd and not worked for 1234 user.

When I use
execute immediate 'alter user '||'"'||user||'"'||' identified by '||'"'||pass'"';
it works for numaric users i.e. 1234 and not worked for character user i.e. abcd.

How to do it for both type of users with this procedure.

When setting a password: its length must be between 1 and 30 characters, the first character must be one of A-Z or 0-9. Other password characters may be A-Z (a-z), 0-9, underscore (_), dollar ($) or hash (#).
In Oracle 11g passwords are case sensitive, in older versions passwords are not case sensitive.

SQL> create user 1234 identified by 1234;
create user 1234 identified by 1234
            *
ERROR at line 1:
ORA-01935: missing user or role name


SQL> create user abcd identified by 1234;
create user abcd identified by 1234
                               *
ERROR at line 1:
ORA-00988: missing or invalid password(s)


SQL> create user abcd identified by abcd;

User created.

SQL> select banner from v$version;

BANNER
----------------------------------------------------------------
Oracle Database 10g Express Edition Release 10.2.0.1.0 - Product
PL/SQL Release 10.2.0.1.0 - Production
CORE    10.2.0.1.0      Production
TNS for 32-bit Windows: Version 10.2.0.1.0 - Production
NLSRTL Version 10.2.0.1.0 - Production

SQL> drop user abcd cascade;

User dropped.

SQL> create user abcd identified by '1234';
create user abcd identified by '1234'
                               *
ERROR at line 1:
ORA-00988: missing or invalid password(s)


SQL> create user abcd identified by "1234";

User created.

SQL> drop user abcd cascade;

User dropped.

SQL> create user abcd identified by "_1234";

User created.

SQL> drop user abcd cascade;

User dropped.

SQL> create user abcd identified by "@_1234";

User created.

its length must be between 1 and 30 characters, the first character must be one of A-Z or 0-9. Other password characters may be A-Z (a-z), 0-9, underscore (_), dollar ($) or hash (#).

SQL> grant create session to test identified by "123#àç%ù";

Grant succeeded.

SQL> connect test/"123#àç%ù"
Connected.

In Oracle 11g passwords are case sensitive, in older versions passwords are not case sensitive.

What I wanted to mean is that the password can not start with a digit

How can I message to user on success "Password changed uccessfully.