Edit User Information for other user - php

Question

Sorry I'm beginner in PHP MYSQL.
I want to ask how this will work. May I know how to fix this or what code will I add?
Scenario:
We have user type ADMIN and NORMAL USER,
I created edit.php to edit user accounts as an ADMIN incase of lost password etc. but I have problem was when I click Edit button in specific table.
See Picture Below, I logged in here as an Admin, employee.php.
So I choose the user testFN with the id of 22
The code I used here to fetch the id is here :
<td><a href="edit.php?id=<?php echo $row['user_id']; ?>" >Edit</a></td>
When I click the EDIT button it will open the page edit.php, with this url
So I the outcome is not equal to what I want, the information to the input boxes were from the user I'm using/logged in not from the user I chose to edit.
The code I used to EDIT.PHP is here:
<?php
session_start();
include_once 'dbconnect.php';
if(!isset($_SESSION['user']))
{ header("Location: edit.php"); }
$res=mysql_query("SELECT * FROM accounts WHERE user_id=".$_SESSION['user']);
$userRow=mysql_fetch_array($res);
if(isset($_GET['user'])) {
$id = $_GET['user'];
if(isset($_POST['submit'])) {
$pass = md5(mysql_real_escape_string($_POST['pass']));
$aFName = mysql_real_escape_string($_POST['aFName']);
$aLName = mysql_real_escape_string($_POST['aLName']);
$aMName = mysql_real_escape_string($_POST['aMName']);
$aContact = mysql_real_escape_string($_POST['aContact']);
$aAddress = mysql_real_escape_string($_POST['aAddress']);
$aGender = mysql_real_escape_string($_POST['aGender']);
$utype = mysql_real_escape_string($_POST['utype']);
$query3=mysql_query("UPDATE accounts SET pass='$pass', agentFName ='$aFName', agentLName = '$aLName',
agentMName = '$aMName', agentContact = '$aContact', agentAddress = '$aAddress',
agentGender = '$aGender', user_type = '$utype' ");
if($query3)
{ header("Location: home.php"); }
}//end of post sumbit
}//end of GET
?>
/** HTML IS HERE **/
Agent ID: <input type="text" id="agentCode" name="agentCode" required="required" value="<?php echo $userRow['user_id']; ?>" >
First Name: <input type="text" id="agentCode" name="aFName" required="required" value="<?php echo $userRow['agentFname']; ?>" >
Middle Name: <input type="text" id="agentCode" name="aMName" required="required" value="<?php echo $userRow['agentMname']; ?>" >
Last Name: <input type="text" id="agentCode" name="aLName" required="required" value="<?php echo $userRow['agentLname']; ?>" >

Answer 1

This is where you set the value for that text input:
value="<?php echo $userRow['user_id']; ?>"
Where does $userRow come from? This:
$userRow=mysql_fetch_array($res);
What query was used to fetch the data? This:
$res=mysql_query("SELECT * FROM accounts WHERE user_id=".$_SESSION['user']);
So... you're specifically fetching the data from the logged-in session user, rather than the one specified on the query string. Just use the query string value instead of the session value.
Important:
Using user-supplied values directly in SQL queries is called a SQL injection vulnerability. It's a very bad thing. You're going to want to use query parameters and prepared statements. This is a good place to start reading.
You're really going to want to check if the logged-in user is authorized to edit the specified user before allowing them to do so. Any user can manually add/change query string values or POST values or basically anything that comes from the client.