sql - ORA-00922: missing or invalid option on changing the user password -

this plsql returning error:

ora-00922: missing or invalid option

declare begin  execute immediate 'alter user upper(:username) identified :new_password replace :old_password';  end; 

ddl statements alter belongs cannot contain bind variables - :username, :new_password, :old_password

use

execute immediate 'alter user ' || upper(:username) || ' identified ' || :new_password || ' replace ' || :old_password; 

instead.