更新数据库中的记录

Question

guys, i have these codes for updating the records in the database.

please.. check if these is correct?

<?php
session_start(); 
include "db.php"; 

$username = $_SESSION['username'];


$query="SELECT * FROM members where username='".mysql_real_escape_string($username)."'";

$result=mysql_query($query);
$num=mysql_numrows($result);

mysql_close();


$userid             =mysql_result($result,$i, 'userid');
$firstname          =mysql_result($result,$i,'firstname');
$lastname           =mysql_result($result,$i,'lastname');
$username           =mysql_result($result,$i,'username');
$email              =mysql_result($result,$i,'email');
$age                =mysql_result($result,$i,'age');
?>

<form action="update.php" method="post">
<input type="hidden" name="u_userid" value="<? echo "$userid" ?>">
<table>
<tr><td>ID:</td> <td><? echo "$userid"?></td></tr>
<tr><td>First Name:</td> <td> <input type="text" name="u_firstname" value="<? echo "$firstname"?>"></td></tr>
<tr><td>Last Name: </td> <td><input type="text" name="u_lastname" value="<? echo "$lastname"?>"></td></tr>
<tr><td>Username:</td> <td> <input type="text" name="u_username" value="<? echo "$username"?>"></td></tr>
<tr><td>Email:</td> <td> <input type="text" name="u_email" value="<? echo "$email"?>"></td></tr>
<tr><td>Age: </td> <td><input type="text" name="u_age" value="<? echo "$age"?>"></td></tr>
<tr><td></td><td><input type="Submit" value="Update Info">
</td></tr>
</form>
<tr><td></td><td><form action="form2.html" method="post">
<input type="submit" value="Cancel"></form></td></tr>
</table

and in update.php

<?php
session_start(); 
include "db.php"; 

$userid             =mysql_result($result, 'userid');
$firstname          =mysql_result($result, 'firstname');
$lastname           =mysql_result($result, 'lastname');
$username           =mysql_result($result, 'username');
$email              =mysql_result($result, 'email');
$age                =mysql_result($result, 'age');

include "db.php"; 

$query="UPDATE members SET firstname='$u_firstname' , lastname='$u_lastname', username='$u_username' , email='$u_email', age='$u_age' ";

$result=mysql_query($query);


mysql_close();

echo "Record Updated
 <br><br>

<form action=\"form2.html\" >
<input type=\"submit\" value=\"ok!\" />
</form>
";

?>

actually it shows a lot of errors/warning like this

Warning: mysql_result(): supplied argument is not a valid MySQL result resource in C:\web\htdocs\salome\this\update.php on line 7

Warning: mysql_result(): supplied argument is not a valid MySQL result resource in C:\web\htdocs\salome\this\update.php on line 8

Warning: mysql_result(): supplied argument is not a valid MySQL result resource in C:\web\htdocs\salome\this\update.php on line 9

Warning: mysql_result(): supplied argument is not a valid MySQL result resource in C:\web\htdocs\salome\this\update.php on line 10

Warning: mysql_result(): supplied argument is not a valid MySQL result resource in C:\web\htdocs\salome\this\update.php on line 11

Warning: mysql_result(): supplied argument is not a valid MySQL result resource in C:\web\htdocs\salome\this\update.php on line 12

WHAT WILL I DO..

please help me... :-(

Answer 1

You are trying to get a result from the database (but even without executing a query) while you have to use edited data from the form via $_POST array

<?php
session_start(); 
include "db.php"; 

$user_id   = mysql_real_escape_string($_SESSION['userid']);

$firstname = mysql_real_escape_string($_POST['u_firstname']);
$lastname  = mysql_real_escape_string($_POST['u_lastname']);
$lastname  = mysql_real_escape_string($_POST['u_lastname']);
$username  = mysql_real_escape_string($_POST['u_username']);
$email     = mysql_real_escape_string($_POST['u_email']);
$age       = mysql_real_escape_string($_POST['u_age']);
//etc

$query     = "UPDATE members SET firstname='$firstname', lastname='$lastname',
                             username='$username' , email='$email', age='$age' 
              WHERE userid = '$user_id'";

$result    = mysql_query($query) or trigger_error(mysql_error().$query);

Note that user identification should come from a SESSION, not FORM
And you should never edit user id.