-1

I'm doing project in eCommerce website using PHP and MySQL. I'm having a problem updating user profile page - when I click update button then I check the database, nothing is changed. These is my update.php.

<?php
    session_start();     
    if(!isset($_SESSION["n"]))
       {
         header("location:error.php");
       }
    if(isset($_POST["submit"]))
     {

      $nm=$_POST["name"];
      $lnm=$_POST["lname"];
      $ad=$_POST["add"];

      $u=$_SESSION["un"];

      $id=$_GET["id"];


         require_once("vars.php");
$conn=mysqli_connect(host,uname,pass,db) or die(mysqli_connect_error());

         $query="update signup set name='$nm', lname='$lnm', address='$ad' where User_ID='$id' ";

         $execute=mysqli_query($conn,$query);$r=mysql_affected_rows();
         mysqli_close($conn);

         if(!$execute)
          {
              $msg="Information Updated Successfully";

          }



           header("location:mydetails.php");
     }  


    ?>
<!DOCTYPE>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<!-- InstanceBeginEditable name="doctitle" -->
<title>Untitled Document</title>
<!-- InstanceEndEditable -->
<!-- InstanceBeginEditable name="head" --><!-- InstanceEndEditable -->
</head>

<body>
<table width="950" align="center">
  <tr>
    <td>
      <table cellspacing="0" cellpadding="0" width="100%">
        <tr align="right">
          <td>Welcome 
          <?php
              if(isset($_SESSION["n"]))
                    {
                       print $_SESSION["n"];

                       print "&nbsp;<a href='myprofile.php'>My Profile</a>";
                       print "&nbsp;<a href='signout.php'>Log Out</a>";
                    }
              else
                    {
                       print "Guest &nbsp;";
                       print "<a href='signup.php'>Sign up</a>&nbsp;";
                       print "<a href='login.php'>Login</a>";                      

                     }
            ?></td>
        </tr>
        <tr>
               <td><img src="pics/new2.JPG" alt="banner" width="950" height="234" /></td>
        </tr>

        <tr align="center">
          <td height="58"><table width="100%">
            <tr align="center">

                  <td width="158" bgcolor="#f9b67b"><a href="index.php"><font color="#FFFFFF">Home</font></a></td>
                  <td width="158" bgcolor="#f9b67b" ><a href="aboutus.php"><font color="#FFFFFF">About us</font></a></td>
                  <td width="158" bgcolor="#f9b67b"><a href="showcat.php"><font color="#FFFFFF">Products</font></a></td>
                <td width="158" bgcolor="#f9b67b"><a href="searchproductbyname.php"><font color="#FFFFFF">Search</font></a></td>
                 <td width="158" bgcolor="#f9b67b"><a href="contactus.php"><font color="#FFFFFF">Contact us</font></a></td>

            </tr>
            <tr align="center">
                 <td colspan="6" align="left"><!-- InstanceBeginEditable name="EditRegion3" -->
                <table width="100%">
                  <tr>
                    <td><form id="form1" name="form1" method="post" action="">
                      <table width="100%">
                        <tr>
                          <td><h2><strong>Update My Information</strong></h2></td>
                          <td>&nbsp;</td>
                        </tr>
                        <tr>
                          <td>&nbsp;</td>
                          <td>&nbsp;</td>
                        </tr>
                        <tr>


                           <tr>
                          </label></td>
                        </tr>
                        <tr>
                          <td><strong>Name:</strong></td>
                          <td><label>
                            <input type="text" name="name" id="name" />
                          </label></td>
                        </tr>
                        <tr>
                          <td><strong>Last name:</strong></td>
                          <td><label>
                            <input type="text" name="lname" id="lname" />
                          </label></td>
                        </tr>
                        <tr>
                          <td><strong>Address:</strong></td>
                          <td><label>
                            <input type="text" name="ad" id="ad" />
                          </label></td>
                        </tr>
                        <tr>
                          <td>&nbsp;</td>
                          <td>&nbsp;</td>
                        </tr>
                        <tr>
                          <td>&nbsp;</td>
                          <td><label>
                            <input type="submit" name="submit" id="submit" value="Update" />
                            <input type="reset" name="reset" id="reset" value="Reset" /></td>
                          </label></td>
                        </tr>
                        <tr>
                          <td>&nbsp;</td>

                        </tr>
                      </table>
                                        </form>
                    </td>
                  </tr>
                  <tr>
                    <td>&nbsp;</td>
                  </tr>
                </table>
              <!-- InstanceEndEditable --></td>
              </tr>
          </table></td>
        </tr>
      </table>
            </td>
  </tr>
  <tr>
    <td>&nbsp;</td>
  </tr>

</table>
</body>

<div id="footer" >

<h4 style="text-align:center">&copy;2016 by www.thebeautyskin.com</h4>
</div>
<!-- InstanceEnd --></html>
</div>
John Hinnegan
  • 5,864
  • 2
  • 48
  • 64
A Alshamsi
  • 11
  • 1
  • 1
    [Little Bobby](http://bobby-tables.com/) says [your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! – Jay Blanchard May 03 '16 at 20:23
  • Have you checked your error logs? You're making an assumption the query is working. – Jay Blanchard May 03 '16 at 20:24
  • also, don't mix apis `mysql_affected_rows()` – I wrestled a bear once. May 03 '16 at 20:28

1 Answers1

0
update signup set name='$nm', lname='$lname', address='$ad'

Where are variables $nm and $ad defined? I see $name and $address....

Webomatik
  • 844
  • 7
  • 7