Yeah but you can't do anything about that unless you also enforce complexity. If the goal is to prevent defaults (ex. to prevent drive-bys), the above does that; "good" passwords is a separate requirement.

its easy to let them type old password then new password twice, that way u can confirm it's not similar to old password atleast since u receive it in unhashed form from the user themselves.