read the man-page for 'passwd' on your system, it has a parameter that lets you read the new password from stdin.
be very VERY VERY carefull with this,
because you are potentially giving hackers a chance to alter the password for crucial services to whatever they want.
(obvious but worth a mention) Only users who have sucesfully logged in should be able to change their password, prefereably only if they logon using SSL
Do not ever let the user enter the username for which the password should be changed, always use only his userid to identify him. When you actually change the password, use that ID to find the real username again.
Do not let the user choose his own password. Instead, generate a random password, and send that to the user in an email.
