Button to perform a PHP script in a table issue - php

Question

I have set a script to show all members of my database in a table that have so called 'Pending Points' . In that table there's a button that an admin can click to send those pending points to 'Points' to the user in that row of the table and resetting the 'Pending Points' to 0. I have made the script to send these points but it doesn't seem to change anything even though it does give the success message. Any help is appreciated !
Here's an image that will clarify:
Code to send the points (sendpoints.php):
<?
include ("connect.php");
$result = mysqli_query($conn,"SELECT * FROM members WHERE pendingpoints > 0 ");
$row = mysqli_fetch_array($result,MYSQLI_ASSOC);
$send = $_POST['send'];
if ($send) {
mysqli_query($conn,"UPDATE members SET points='$newpoints' WHERE
username='$username'");
mysqli_query($conn,"UPDATE members SET pendingpoints='0' WHERE
username='$username'");
$username = $row['username'];
$pendingpoints = $row['pendingpoints'];
$points = $row['points'];
$newpoints = $points + $pendingpoints;
echo "Succesfully changed points for that user";
}
?>
Code to show the table:
<?
include ("connect.php");
$submit = $_POST['submit'];
if ($submit) {
$result = mysqli_query($conn,"SELECT * FROM members WHERE pendingpoints > 0 ");
$row = mysqli_fetch_array($result, MYSQLI_ASSOC);
while ($row = mysqli_fetch_assoc($result))
{
$username = $row['username'];
$pendingpoints = $row['pendingpoints'];
$points = $row['points'];
$newpoints = $points + $pendingpoints;
$ip = $row['ip'];
echo "<table border='1'>
<tr>
<td><b>Username:</b></td>
<td><b>Pendingpoints:</b></td>
<td><b>IP:</b></td>
<td><b>Confirm Points:</b></td>
</tr>
<tr>
<form id='1' action='sendpoints.php' method='post'>
<td> $username </td>
<td> $pendingpoints </td>
<td> $ip </td>
<td><input type='submit' class='classname' name='send' value='Send'></form></td>
</tr>
<br> </table>";
}
}
?>

Answer 1

As per my understanding you want to send points on button click only to specific person but in your code your doing something else..
note: i added hidden variable in your form to send points to only that specific user
<?
include ("connect.php");
if (isset($_POST['send'])) {
$username=$_POST'username'];
$result = mysqli_query($conn,"SELECT * FROM members WHERE username='$username' ");
$row = mysqli_fetch_array($result,MYSQLI_ASSOC);
$pendingpoints = $row['pendingpoints'];
$points = $row['points'];
$newpoints = $points + $pendingpoints;
$q=mysqli_query($conn,"UPDATE members SET points='$newpoints',pendingpoints=0 WHERE
username='$username'");
if($q){
echo "Succesfully changed points for that user";
}
}
?>
Code to show the table:
<?
include ("connect.php");
$submit = $_POST['submit'];
if ($submit) {
$result = mysqli_query($conn,"SELECT * FROM members WHERE pendingpoints > 0 ");
$row = mysqli_fetch_array($result, MYSQLI_ASSOC);
while ($row = mysqli_fetch_assoc($result))
{
$username = $row['username'];
$pendingpoints = $row['pendingpoints'];
$points = $row['points'];
$newpoints = $points + $pendingpoints;
$ip = $row['ip'];
echo "<table border='1'>
<tr>
<td><b>Username:</b></td>
<td><b>Pendingpoints:</b></td>
<td><b>IP:</b></td>
<td><b>Confirm Points:</b></td>
</tr>
<tr>
<td> $username </td>
<td> $pendingpoints </td>
<td> $ip </td>
<td><form id='1' action='sendpoints.php' method='post'><input type='submit' class='classname' name='send' value='Send'><input type='hidden' name='username' value='$username'></form></td>
</tr>
<br> </table>";
}
}
?>

Answer 2

In the first script $row is not defined.
Edit: since the code was updated, the logic seems to be incorrect. You need to pull username from $_POST, and use this in the update.
However, two big problems: you are not handling escaping of special chars like '. This can break the form, and open up mysql injection security holes.