使用UPDATE更新MySQL中的用户数据[关闭]

Question

I have run into an issue with my Administrator panel. I have an issue where when you try to update the profile by having the users preferences, it tends to keep the user data the same. I do not have any issues.

Listed below is the code for user.php

<?php

    include 'includes/db.php';
    include 'includes/protect.php';

    if(isset($_POST['submit_update'])){

        $firstName = $_POST['fname'];
        $lastName = $_POST['lname'];
        $email = $_POST['email'];
        $aboutMe = $_POST['about_me'];

        $query = "UPDATE users 
                  SET firstName = '$firstName', 
                      lastName = '$lastName', 
                      email = '$email', 
                      about_me = '$aboutMe', 
                  WHERE email = '$_SESSION[email]'";

        $edit_query = mysqli_query($conn, $query);
    }   
?>

Answer 1

The sure shot issue is with your $_SESSION[email]. But I think you also need few changes on your existing code. You can try like this way-

1. Check value is exits or not before assigning the $_POST variable using isset() here I've assigned empty string by default you can change it as per your requirement. Also see how can you escape using http://php.net/manual/en/mysqli.real-escape-string.php

2. Put your $_SESSION['email'] variable to a new variable in that case I used $sess_email. (this will be more readable)

3. Remove extra comma(,) that you've put inside your UPDATE query.

<?php
    $firstName = isset($_POST['fname']) ? $_POST['fname'] : "" ;
    $lastName = isset($_POST['lname']) ? $_POST['lname'] : "";
    $email = isset($_POST['email']) ? $_POST['email'] : "";
    $aboutMe = isset($_POST['about_me']) ? $_POST['about_me'] : "";
    $ses_email = isset($_SESSION['email']) ? $_SESSION['email'] : "";

    $query = "UPDATE users SET firstName = '$firstName', lastName = '$lastName', email = '$email', about_me = '$aboutMe' WHERE email = '$sess_email'";
    $edit_query = mysqli_query($conn, $query);
?>
    

I also urge you to see how you can easily prevent SQL Injection if you use Prepared Statements in PHP.

</div>