Issue in updating the database, using php/mysql - php

Question

I have this problem while updating my database, so, it all works, i mean i have the form, it prints the values, but when i try to update it, everything gets updated apart from the username and password..
Here is the code i use..
Thanks!
if ($Act=='Save') {
mysql_query("BEGIN");
$sql = "Insert into tbl_galleries (gal_title,gal_image,username,password) Values (";
$sql.= "'". strip_tags(mysql_real_escape_string(trim($gal_title))). "','". strip_tags(mysql_real_escape_string(trim($gal_image))) ."','". strip_tags(mysql_real_escape_string(trim($username))). "',,'". strip_tags(mysql_real_escape_string(trim($password))). "',);";
$query = mysql_query($sql);
if(!$query){
mysql_query("ROLLBACK");
$myErrorsUpGr = mysql_error();
echo $myErrorsUpGr;
} else {
mysql_query("COMMIT");
echo 'Insertion was successfull.';
}
} else if ($Act=='Update'){
mysql_query("BEGIN");
$sql = " Update tbl_galleries set ";
$sql.= " gal_title='" . strip_tags(mysql_real_escape_string(trim($gal_title))) . "',";
$sql.= " gal_image='" . strip_tags(mysql_real_escape_string(trim($gal_image))) . "'";
$sql.= " where gal_id=" . $gal_id . ";";
$sql.= " username='" . strip_tags(mysql_real_escape_string(trim($username))) . "',";
$sql.= " password='" . strip_tags(mysql_real_escape_string(trim($password))) . "',";
<?php
include_once("db/envato_db.php");
if ($_SERVER['QUERY_STRING']!='')
{
$sql = "";
$sql = "SELECT gal_id,gal_title,gal_image,username,password FROM tbl_galleries where gal_id='" . $_REQUEST['gid'] ."';";
$query = mysql_query($sql) or $myErrorsP = mysql_error();
if(isset($myErrors) && $myErrorsP!='')
{
}
else
{
$row = mysql_fetch_row($query);
mysql_free_result($query);
$gal_id = $row[0];
$gal_title = $row[1];
$gal_image = $row[2];
$username = $row[3];
$password = $row[4];
}
}
?>
<tr>
<td width="104">Gallery Title:</td>
<td width="556"><input type="text" id="gtitle" name="gtitle" class="typeText" maxlength="50" value="<?php echo isset($gal_title)? $gal_title : ""?>" tabindex="1" /></td>
</tr>
<tr>
<td>Gallery Image:</td>
<td>
<input type="text" id="gimg" name="gimg" class="typeText" maxlength="100" value="<?php echo isset($gal_image)? $gal_image : ""?>" readonly/>
<input type="file" name="gimg_upl" id="gimg_upl"/>
Upload
</td>
</tr>
<tr>
<td width="104">Username:</td>
<td width="556"><input type="text" id="gusername" name="gusername" class="typeText" maxlength="50" value="<?php echo isset($username)? $username : ""?>" tabindex="1" /></td>
</tr>
<tr>
<td width="104">Password:</td>
<td width="556"><input type="text" id="gpassword" name="gpassword" class="typeText" maxlength="50" value="<?php echo isset($password)? $password : ""?>" tabindex="1" /></td>
</tr>
</table>
<table id="savetbl" style="width:680px;" cellpadding="3">
<tr>
<td align="center" colspan="2">
<?php
if(isset($gal_id) && $gal_id!='')
{
if(!isset($myErrorsP))
{
?>
<input type="button" value="» Update «" class="but" name="button" alt="Update" title="Update" onClick="Do_Update('Update', '<?php echo $gal_id?>');" tabindex="3">
<?php
}
}
else
{
if(!isset($myErrorsP))
{
?>
<input type="button" value="» Save «" class="but" name="button" alt="Save" title="Save" onClick="Do_Update('Save','0');" tabindex="3">
<?php
}
}
?>
</td>
</tr>

Answer 1

On your code you have this :
$sql.= " where gal_id=" . $gal_id . ";";
$sql.= " username='" . strip_tags(mysql_real_escape_string(trim($username))) . "',";
$sql.= " password='" . strip_tags(mysql_real_escape_string(trim($password))) . "',";
Try to set the where clause after the update of username & password :
$sql.= " username='" . strip_tags(mysql_real_escape_string(trim($username))) . "',";
$sql.= " password='" . strip_tags(mysql_real_escape_string(trim($password))) . "'";
$sql.= " where gal_id=" . $gal_id . ";";

Answer 2

Try this
$sql.= " where gal_id=" . $gal_id . ";";
$sql.= "AND username='" . strip_tags(mysql_real_escape_string(trim($username))) . "',";
$sql.= "AND password='" . strip_tags(mysql_real_escape_string(trim($password))) . "',";
Lines 22, 23, and 24 of your sample code