Member Avatar for oluchan

Pla can anyone help me with user profile update script.
when user log in with their email and password, the page will redirect user to my account section where user can update profile. how do i populate user details on update profile link.
I will appreciate any help.
Thanks

  • 4 Contributors
  • 6 Replies
  • 304 Views
  • 3 Months Discussion Span
  • Latest Post Latest Post by humbug

Dani AI

Generated

Good outcome for and — the pattern of loading the authenticated user row and using those values to prefill an edit form is correct. Because this thread dates from 2009, an important update for anyone arriving here later: the old mysql_* API is obsolete and insecure for modern apps. A production-ready implementation today should use prepared statements (PDO or mysqli), always escape values placed into HTML (htmlspecialchars), validate input server‑side, and protect the form with a CSRF token.

Example (fetch + render, simplified):

// fetch-and-render.php
session_start();
$uid = (int) ($_SESSION['user_id'] ?? 0);
$pdo = new PDO('mysql:host=localhost;dbname=app;charset=utf8mb4', 'dbuser', 'dbpass', [
  PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
]);
$stmt = $pdo->prepare('SELECT email, full_name FROM users WHERE id = :id');
$stmt->execute([':id' => $uid]);
$user = $stmt->fetch(PDO::FETCH_ASSOC) ?: [];
$_SESSION['_csrf'] = bin2hex(random_bytes(16));
$fullname = htmlspecialchars($user['full_name'] ?? '', ENT_QUOTES, 'UTF-8');
$email = htmlspecialchars($user['email'] ?? '', ENT_QUOTES, 'UTF-8');

Form processing (save):

// save.php
session_start();
if ($_SERVER['REQUEST_METHOD'] !== 'POST') exit;
if (!hash_equals($_SESSION['_csrf'] ?? '', $_POST['_csrf'] ?? '')) { http_response_code(400); exit; }
$uid = (int) ($_SESSION['user_id'] ?? 0);
$full = trim($_POST['full_name'] ?? '');
$email = trim($_POST['email'] ?? '');
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) { /* handle invalid email */ }
$pdo->prepare('UPDATE users SET full_name = :f, email = :e WHERE id = :id')
    ->execute([':f' => $full, ':e' => $email, ':id' => $uid]);

Notes and troubleshooting: cast session IDs to int, regenerate the session id at login, enable PDO exceptions for clear errors, enforce a UNIQUE index on email to detect duplicates, and never echo raw input into HTML without escaping. For password updates use password_hash/password_verify. For file uploads validate MIME type and store outside webroot. For and others seeking a full starter script, the above pattern (authenticate -> load -> render with escaped values -> POST -> validate -> prepared UPDATE) is the safe, current baseline.

Recommended Answers

All 6 Replies

Member Avatar for humbug

Assuming you have all the data stored in a MySQL table you sould need something like this:

<?php
//login to  MySQL db

$result=mysql_query("SELECT * FROM user_settings WHERE id='$_SESSION[user_id]'");
$settings=mysql_fetch_array($result); //now $settings has everything from the user_settings table as an array
echo '<form action=...>'.
     '  <input type="text" name="real_name" value="'.$settings['real_name'].'">'.
     '  ...'.
     '</form>';
?>

This code should output the following where "MY NAME" is the value in the "real_name" column of table "user_settings" in the row with id equal to $_SESSION[user_id].

<form action=...>
  <input type="text" name="real_name" value="MY NAME">
  ...
</form>

You can use the values in the $settings array to fill all of the inputs with the current data. (The code is untested BTW, so may contain syntax errors...)

Hope that helped.

Member Avatar for oluchan

Thanks mate, i finnaly got it working. I appreciate your effort.

Member Avatar for remp

Hello, would it be too much to ask you to help me accomplish the same thing oluchan accomplished?
i don't have anything yet and i have gone crazy looking for something like this... i would REALLY appreciate it, if you could share the script. THANK YOU very much in advance.

Member Avatar for humbug

I am not going to write your code for you - that's the sort of thing I get paid for :P - but I will help you do it yourself.

The way I would do it is as follows:
You will need

  • A place to store the data (MySQL table)
  • A form for the user to edit the data (form.php)
  • A script that will process any data that the user submits (save.php)

When you create the user, you can create an empty entry in the MySQL table.

form.php will first get the stored data and echo the html for a form using the trick above to put the data into the "value" attribute of the inputs in your form. This way, all the fields are already filled in with whatever the user entered last time.

The form should be pointed at the script that deals with the data (action="save.php"). save.php will use the data to create an UPDATE query for the database.

If you don't know how to do any of these steps, look at tutorials for each step (starting with forms, etc.) and you will soon learn how it all works, that's what I did!

Member Avatar for BzzBee

apply update quesry after testing if record already exist on the basis of session variable

Member Avatar for humbug

You could even use an "INSERT ... ON DUPLICATE KEY UPDATE ..." query (if you have a primary key "id" column) but that's getting complicated.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.