dove sbaglio?

[code]set cn= Server.CreateObject("ADODB.Connection")
strConn = "Provider = Microsoft.Jet.OLEDB.4.0; Data Source=" &_
Server.MapPath("../mdb-database/pb.mdb")
cn.Open strConn

nuova = request.form("nuova")
username= request.cookies("login")

Sql = "UPDATE utenti SET password ='" & nuova & "' WHERE username = '" & username & "' "
cn.execute sql

cn.Close
set cn = Nothing[code]

errore

Microsoft JET Database Engine error '80040e14'

Syntax error in UPDATE statement.

/asp/password.asp, line 11