Fixed Potential SQL Injection vulnerability in changePassword method

In the changePassword method there was no escaping on the $newPassword variable, just added it.