Display and update user information - php

Question

I new to PHP and learning to update the user information in the mysql. The problem here is I am not able to display the data on the form nor able to update the user's information. My form seems to be empty instead of having any user information
<?php
session_start();
require('config.php');
error_reporting(0);
if(isset($_POST["submit"]))
{
$sqlupdate = mysql_query("UPDATE user
SET
first_Name = '{$_POST['sname']}',
password = '{$_POST['spassword']}',
WHERE first_Name = '{$_POST['sname']}'
");
}
$sql=mysql_query("SELECT * FROM student WHERE email='$_SESSION['SESS_USEREMAIL']' and password ='$_SESSION['SESS_USERPASS']' ");
while($record = mysql_fetch_array($sql)){
$first = $record['first_Name'];
$second = $record['first_Name'];
}
?>
<form method="post" name="studentform" id="student-form" action="#" enctype="multipart/form-data">
<div class="form-group">
<div class="inputGroupContainer">
<div class="input-group">
<span class="input-group-addon"><i class="glyphicon glyphicon-home"></i></span>
<input name="sname" id="studentname" placeholder="Name" class="form-control" type="text" value="<?php echo $first; ?>">
</div>
</div>
</div>
<div class="form-group">
<div class="inputGroupContainer">
<div class="input-group">
<span class="input-group-addon"><i class="glyphicon glyphicon-lock"></i></span>
<input name="spassword" id="studentpassword" placeholder="Password" class="form-control" type="password" value="<?php echo $second; ?>">
</div>
</div>
</div>
<div class="form-group">
<button type="submit" id="ssubmitbtn" class="btn btn-primary btn-md" value="submit" name="submit">Submit<span class="glyphicon glyphicon-pencil "></button>
</div>
</form>

Answer 1

Assuming that your SQL is correct, you could use PDO's as followed;
<?php
$sFirst = '';
$sLast = '';
$conn = new PDO( DB_DSN, DB_USERNAME, DB_PASSWORD );
$sql = "SELECT * FROM user WHERE email= :email and password = :password";
$st = $conn->prepare( $sql );
$st->bindValue(":email", $name, PDO::PARAM_STR);
$st->bindValue(":password", $password, PDO::PARAM_STR);
$st->execute();
if ( $row = $st->fetch() ){
$sFirst = $row['first_col_name'];
$sLast = $row['seccond_col_name'];
}
?>
You mention setting the values in the query from a session, using the following lines you can assign what ever var to be bound to the query;
$st->bindValue(":email", $_SESSION['SESS_USEREMAIL'], PDO::PARAM_STR);
$st->bindValue(":password", $_SESSION['SESS_USERPASS'], PDO::PARAM_STR);
And for your update you could use something like;
if(isset($_POST["submit"]))
{
$sError = '';
$sName = '';
$sPassword = '';
// basic error checking
if(isset($_POST['sname']) && $_POST['sname'] != ''){
$sName = $_POST['sname'];
}
if($sName == '') $sError .= "[MissingName]";
if(isset($_POST['spassword']) && $_POST['spassword'] != ''){
$sPassword = $_POST['spassword'];
}
if($sPassword == '') $sError .= "[MissingPassword]";
// if no errors, proceed to update
if($sError == ''){
$conn = new PDO( DB_DSN, DB_USERNAME, DB_PASSWORD );
$sql = "UPDATE user first_name = :firstName, password = :password WHERE first_name :first_name";
$st = $conn->prepare( $sql );
$st->bindValue(":firstName", $_POST['sname'], PDO::PARAM_STR);
$st->bindValue(":password", $_POST['spassword'], PDO::PARAM_STR);
$st->execute();
}
}
Before updating I would check/validate the information entered is expected.
I would also use a Unique Identifier when updating to ensure the correct user is updated. For this I normally create a trigger on the table that will generate a short unique code.

Answer 2

$sql=mysqli_query("SELECT * FROM user WHERE email='$useremail' and password ='$userpassword' ");
$record = mysqli_fetch_array($sql);
instead write <?php echo $first... use <?php echo $redord['firstname] ;?>
This shoud solve your problem.
P.S
$useremail and $userpassword must stored in a session (in login page)
USE:
$_SESSION['usermail'] = $usermail;
$_SESSION['userpassword'] = $userpassword;
IN QUERY
$sql=mysql_query("SELECT * FROM user WHERE email='$useremail' and password ='$userpassword' ");
replace $usermail with $_SESSION['username']; and $userpassword with $_SESSION['userpassword'];