sigmahokies,
You need to understand that just because something works does not mean it is correct. I can store a user's password in plain text in the database and it will work, but is absolutely wrong. Yes you "can" pass all of the data and it will work. But, it is not correct and will eventually cause you problems either in this project or another one some time later if you do the same thing. You should treat ALL user supplied data as "dirty". It could be that something is corrupted unintentionally or, worse, it malicious data intended to do harm.
For your page above, it should only accept the ID for the process of setting up the form for edit. The code should do a SELECT query to get the current data instead of relying upon data submitted by the user via $_GET.
Here is a quick rewrite of your code in a more logical format. This is not what I would consider complete, but is more complete than the current code and shows an example of a logical flow. There may be some minor errors in syntax as I did not test it.
<?php
$Garydb = mysqli_connect("XXXXX","XXXXX","XXXXX") or die("Could not connect MySQL Database");
mysqli_select_db($Garydb, "XXXXX") or die("Could not find a Database");
$response = '';
if(isset($_GET['id']))
{
//User passed the ID of a record to be updated
//Get current values to populate form field
$id = intval($_GET['id']);
$query = "SELECT First_name, Last_name, Locations, birthdate, Email
FROM
WHERE ID = {$id}";
$result = mysqli_query($Garydb, $query);
if(!mysqli_num_rows($result))
{
//No record matching the passed ID
$response = 'Error: No record matching requested id.';
}
else
{
//Define variables for form fields from current DB result
$row = mysqli_fetch_assoc($result);
$first_name = $row['first_name'];
$last_name = $row['last_name'];
$locations = $row['locations'];
$birthdate = $row['birthdate'];
$email = $row['email'];
}
}
elseif ($_SERVER['REQUEST_METHOD']!='POST')
{
//User posted a form if data to be updated for a record
$id = intval($_POST['id']);
$first_name = trim($_POST['first_name']);
$last_name = trim($_POST['last_name']);
$locations = trim($_POST['locations']);
$birthdate = trim($_POST['birthdate']);
$email = trim($_POST['email']);
if ($id && $first_name && $last_name && $locations && $birthdate && $email)
{
//All the posted value are not empty/zero
//Should really have better validation logic
$update = "UPDATE Members
SET FirstName = '$first_name',
LastName = '$last_name',
Locations = '$locations',
birthdate = '$birthdate',
Email = '$email'
WHERE ID = $id";
if(!mysqli_query($Garydb, $query) || )
{
//Query failed
$response = 'Error: Unable to update record.';
}
elseif(!mysqli_affected_rows($link))
{
//No records were updated. Record may have been deleted or ID manipulated
$response = 'Error: No records updated.';
}
else
{
$response = 'Record was updated.';
}
}
else
{
//Not all fields have values or non-zero
$response = 'Error: Missing data required for update.';
}
}
else
{
//No POST or GET data submitted
$response = 'Error: No data received.';
}
?>
<!doctype html>
<html>
<head>
<title>Update Members info</title>
</head>
<body>
<?php
//If there was a response, show it. Else show form.
if($response)
{
echo "<div style=\"color:red;\">{response}</div>";
//Could add a link to go back to a listing page or somewhere appropriate
}
else
{
?>
<form action="insert.php" method="POST">
<table>
<tr>
<td>Identify Number:</td>
<td><?php echo $id ?><input type="hidden" name="id" value="<?php echo $id; ?>"</td>
</tr>
<tr>
<td>First Name:</td>
<td><input type="text" name="first_name" value="<?php echo $first_name; ?>"></td>
</tr>
<tr>
<td>Last Name:</td>
<td><input type="text" name="last_name" value="<?php echo $last_name; ?>"></td>
</tr>
<tr>
<td>Locations:</td>
<td><input type="text" name="locations" value="<?php echo $locations; ?>"></td>
</tr>
<tr>
<td>birthdate:</td>
<td><input type="text" name="birthdate" value="<?php echo $birthdate; ?>"></td>
</tr>
<tr>
<td>Email:</td>
<td><input type="text" name="email" value="<?php echo $email; ?>"></td>
</tr>
<tr>
<td colspan="2"><button type="submit">Update</button></td>
</tr>
</table>
</form>
<?php
}
?>
</body>
</html>
