<?php
session_start();
include_once 'dbconnect.php';
//for the session user it allows only logged in user to view
if (!isset($_SESSION['user']) && !isset($_SESSION['user_id'])) {
header("Location: index.php");
exit; //use exit() so the script does not continue to run
}
// to get the data of the name and display welcome! (blablabla)
$res=mysql_query("SELECT * FROM users WHERE user_id='" . $_SESSION['user'] . "'");
$userRow=mysql_fetch_array($res);
$customers = mysql_query("SELECT * FROM users where user_id='" . $_SESSION['user_id'] . "'");
$customer = mysql_num_rows($customers);
if ($customer == 1) {
$row = mysql_fetch_assoc($customers);
if (isset($_POST['submit'])) {
//you should check if values exist and data you expect
//you can check each one of these else make an error or keep values from database
if (isset($_POST['new_realname']) && trim($_POST['new_realname']) != '') {
$realname = $_POST['new_realname'];
} else {
$realname = $row['realname'];
}
if (isset($_POST['new_username']) && trim($_POST['new_username']) != '') {
$username = $_POST['new_username'];
} else {
$username = $row['username'];
}
if (isset($_POST['new_email']) && !filter_var($_POST['new_email'], FILTER_VALIDATE_EMAIL) === false) {
$email = $_POST['new_email'];
} else {
$email = $row['email'];
}
if (isset($_POST['new_password']) && trim($_POST['new_password']) != '') {
$password = md5($_POST['new_password']); //use password_hash() and password_verify()
} else {
$password = $row['password']; //can't reverse hashed passwords to show in form
}
if (isset($_POST['new_address']) && trim($_POST['new_address']) != '') {
$address = $_POST['new_address'];
} else {
$address = $row['address'];
}
//escape values before inserting with mysql_real_escape_string, mysqli_real_escape_string or pdo and prepared statements
if (mysql_query("UPDATE users
SET realname='" . mysql_real_escape_string($realname) . "', username='" . mysql_real_escape_string($username) . "', email='" . mysql_real_escape_string($email) . "', password='$password', address='" . mysql_real_escape_string($address) . "'
WHERE user_id='" . $_SESSION['user_id'] . "'")) {
header("Location: editprofileLog.php");
exit;
} else {
?>
<script>alert('error while updating you...');</script>
<?php
}
}
} else {
echo "No user with that id";
}
?>
Welcome! <b><?php echo $userRow['username']; ?>
<form method="POST">
<table border="0">
<tr>
<td><input type="text" name="new_realname" value="<?php echo $realname ?>" placeholder="Real Name" required /></td>
</tr>
<tr>
<td><input type="text" name="new_username" value="<?php echo $username ?>" placeholder="User Name" required /></td>
</tr>
<tr>
<td><input type="email" name="new_email" value="<?php echo $email ?>" placeholder="Your Email" required /></td>
</tr>
<tr>
<td><input type="password" name="new_password" value="<?php echo $password ?>" placeholder="Type if want new password" /></td>
</tr>
<tr>
<td><input type="text" name="new_address" value="<?php echo $address ?>" placeholder="Address" required /></td>
</tr>
<tr>
<td><button type="submit" name="submit" value="submit">Update</button></td>
</tr>
</table>
</form>
I have kind of edited QuickOldCar code. Sorry if I am wrong, learning the process of coding.
I have 3 data inside my database, which have user_id "1", "2," and "3"
