I’m trying to create Edit Profile by user with MySQL and PHP but there’s something wrong and I can’t figure it out. My code looks like this —> editprofileHTML.php:
<?php
include_once "includes/connector.inc.php";
if (!isset($firstname)) {
$firstname = "";
}
if (!isset($lastname)) {
$lastname = "";
}
if (!isset($gender)) {
$gender = "";
}
if (!isset($username)) {
$username = "";
}
if (!isset($phoneNr)) {
$phoneNr = "";
}
?>
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet"
integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous">
<link rel="stylesheet" href="editprofile.css">
<link rel="icon" href="img/newslettericon.png">
<title>Edit Profile</title>
</head>
<body>
<?php
require_once "menu.php";
?>
<div class="container titleHolder">
<h1 class="firstTtile">Edit Profile</h1>
<a href="profile.php" class="secondTitle"><-Back</a>
</div>
<div class="container">
<form class="row g-3" action="includes/editprofile.inc.php" method="post">
<div class="col-md-6">
<label for="firstname" class="form-label">Firstname</label>
<input type="text" class="form-control" id="firstname" placeholder="Add your firstname..."
name="firstname" value="<?php echo $firstname; ?>">
</div>
<div class="col-md-6">
<label for="lastname" class="form-label">Lastname</label>
<input type="text" class="form-control" id="lastname" placeholder="Add your lastname..."
name="lastname" value="<?php echo $lastname; ?>">
</div>
<div class="col-md-12">
<label for="username" class="form-label">Username</label>
<input type="text" class="form-control" id="username" placeholder="Add your Username..."
name="username" value="<?php echo $username; ?>">
</div>
<div class="col-12">
<label for="phoneNr" class="form-label">Phone Number</label>
<input type="text" class="form-control" id="phoneNr" placeholder="Please type in your Phone Number..." value="<?php echo $phoneNr; ?> "
name="phoneNr">
</div>
<div class="col-12">
<label for="gender" class="form-label">Gender</label>
<select class="form-control" name="gender" id="gender">
<option selected="" name="none">Please select your gender...</option>
<option id="female" name="female" <?php if($gender == "female"){?> selected="selected" <?php }?>>Female</option>
<option id="male" name="male" <?php if($gender == "male"){?> selected="selected" <?php }?>>Male</option>
<option id="other" name="other" <?php if($gender == "none"){?> selected="selected" <?php }?>>Decline to Answer</option>
</select>
</div>
<?php
echo $error;
?>
<div class="col-12">
<button type="submit" id="update" name="update" class="btn">Save Changes</button>
<a type="submit" id="link" href="##" class="btn">Change Password</a>
</div>
</form>
</div>
</body>
</html>
and this is editprofile.inc.php:
<?php
error_reporting(E_ALL);
ini_set("display_errors", true);
session_start();
require_once "dbh.inc.php";
require_once "functions.inc.php";
if (isset($_POST["update"])) {
$updatedData = [
"firstname" => $_POST["firstname"],
"lastname" => $_POST["lastname"],
"phoneNr" => $_POST["phoneNr"],
"username" => $_POST["username"],
"gender" => $_POST["gender"],
];
if (matchingUsername($updatedData["username"]) !== true) {
$error = '<p class="error" > Please write your Username correctly </p>';
}
if (invalidPhoneNr($updatedData["phoneNr"]) === true) {
$error = '<p class="error" > Invalid Phone Number! </p>';
}
if (!empty($error)) {
require_once "/profile.php";
exit();
}
updateUser($updatedData);
} else {
header('Location: /editprofileHTML.php');
}
The functions I used in functions.php:
function updateUser($updatedData) {
global $conn;
$sql = 'UPDATE login SET firstname = "firstname", lastname = "lastname", username = "username", phoneNr = "phoneNr", gender = "gender" WHERE id = "id"';
$conn->query($sql);
if ($conn->error){
throw new Exception("Error updating user: " . $conn->error);
}
return true;
}
function matchingUsername($username) {
$user = loadUserByUsername($username);
if ($username === $user) {
return true;
} return false;
}
function loadUserByUsername($username) {
global $conn;
$sql = 'SELECT * FROM login WHERE username = "'.$username.'"';
$result = $conn->query($sql);
return $result->fetch_assoc();
}
>Solution :
I think your error is in functions.php within the line of $sql = 'UPDATE login SET firstname = "firstname", lastname = "lastname", username = "username", phoneNr = "phoneNr", gender = "gender" WHERE id = "id"';
You are setting firstname as "firstname", however it should look more like this:
$sql = 'UPDATE login SET firstname = "'.$updatedData["firstname"].'", lastname = "'.$updatedData["lastname"].'",....
And so on.
Edit: Check Dharmans comment to my answer, this solution is open to SQL Injection.