Update user details form

[sted999]

Hiya all.
I am trying to build a form that allows users to update their details held in the database. I've gone for the approach of having the fields already stating what is in the database, but I have now come across another problem. When i click update it just reverts back to the original data in the database becuase its calling the variable which holds the data. What variable should i put in the mysql query instead?
Thanks

 <?php

         include ('connect.php'); 
         mysql_select_db("a6188092") or die(mysql_error());
         
         $members = mysql_query(sprintf("SELECT * FROM Member WHERE loginName='%s'", mysql_real_escape_string(trim($_COOKIE['loginName'])))) or die ('SQL Error: ' . mysql_error());

         $fetch = mysql_fetch_array($members);
         
         $loginName = $fetch['loginName'];
         
         echo 'New user name: <input type="text" size="20" maxlength="15" name="userName" value="'.$loginName.'" />';
         echo "<br />";
         
         
         if ($_POST['edit'] == 'Update your account')
         {
                     
         $query = mysql_query(sprintf("UPDATE Member SET loginName='$loginName' WHERE loginName='%s'", mysql_real_escape_string(trim($_COOKIE['loginName'])))) or die ('SQL Error: ' . mysql_error());
      
            echo("Details updated. <br /><br /><br />");
         } 
         ?>

[steelaz]

Are you sure data is not saved in database? You are echoing old data before updating it, try updating it first and then echoing:

<?php

         include ('connect.php'); 
         mysql_select_db("a6188092") or die(mysql_error());
         
         if ($_POST['edit'] == 'Update your account')
         {
                     
         $query = mysql_query(sprintf("UPDATE Member SET loginName='$loginName' WHERE loginName='%s'", mysql_real_escape_string(trim($_COOKIE['loginName'])))) or die ('SQL Error: ' . mysql_error());
      
            echo("Details updated. <br /><br /><br />");
         } 

         $members = mysql_query(sprintf("SELECT * FROM Member WHERE loginName='%s'", mysql_real_escape_string(trim($_COOKIE['loginName'])))) or die ('SQL Error: ' . mysql_error());

         $fetch = mysql_fetch_array($members);
         
         $loginName = $fetch['loginName'];
         
         echo 'New user name: <input type="text" size="20" maxlength="15" name="userName" value="'.$loginName.'" />';
         echo "<br />";
?>

[masterofollies]

One problem I see is that you are calling a cookie. You don't want to use cookies for this, keep it strictly SESSIONS

[sted999]

Thanks for the tip on the cookies, i didnt think there was a problem with them but now I have found a bug - i'll fix that later.

About moving the update further up, this changed the fields in the database but only with blank data?? Any body know why?

[masterofollies]

When you use a POST method, you need to extract the data like so

if (isset($_POST['submit'])) {
$name = $_POST['name'];
$email = $_POST['email'];
$id = $row['id'];

mysql_query("UPDATE users SET name='$name', email='$email' WHERE id='$id'");
}