[kh99]

In profile.php, it's the section that starts with:

// ############################### start update password ###############################

Anyway, if you have a password the user entered, say in $password for example (in profile.php it's in $vbulletin->GPC['currentpassword']), then you'd do something like:

if (md5(md5($password).$vbulletin->userinfo['salt']) == $vbulletin->userinfo['password'])
{
   //password OK
}
else
{
   // password bad
}

But to complicate things, the vb code has javascript which does an md5 on the password so that it's not sent in clear text, except that the code has to work if someone has javascript disabled, so the code is a little complicated because it allows for either case. I don't know if you want to bother with that or not.

Regarding the strike system, I don't think you have to worry about that if you're only allowing your page to be executed by users who are already logged in.