Member Avatar for SharkJr

after i key-in the form, the function change the whole column with the same value for example if i put first name JOHN it will update whole column with JOHN 

            <?php

            session_start();
            require_once("connection.php");

            if (isset($_POST['edit'])) 
            {
              session_start();

                $s=mysqli_query($con,"UPDATE user SET first_name ='" . $_POST['first_name'] . "'");
                $row = mysqli_fetch_assoc($s);
              if ($s)
              { $_SESSION['user_name']=$_POST['user_name'];
                $_SESSION['first_name']=$_POST['first_name'];
                echo "<script type='text/javascript'>alert('Successful - Record Updated!'); window.location.href = 'profile.php';</script>"; }
            else
              { echo "<script type='text/javascript'>alert('Unsuccessful - ERROR!'); window.location.href = 'profile.php';</script>"; }
            }

?>

Edited by SharkJr
  • 4 Contributors
  • 3 Replies
  • 428 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by anand9796

Dani AI

Generated

The root cause is the UPDATE running without a row-specific condition, so every row gets the same value. In ’s snippet the query has no targeted WHERE, the script calls session_start() twice, and it calls mysqli_fetch_assoc() on an UPDATE (which returns true/false, not a result set). was right to question the record handling, and and were correct that the statement needs to target a single record.

Recommended approach: identify the row by a stable unique key (best: the numeric primary key kept in session, not a mutable POST value), validate and trim input, use a prepared statement to avoid injection, check affected_rows to confirm the update, and update session values only after a successful write. Avoid sending output before using a header() redirect, or use the same JavaScript approach intentionally but consistently.

A minimal, safer pattern (illustrative — table/column names should match the actual schema):

session_start();
require_once 'connection.php';

if ($_SERVER['REQUEST_METHOD'] === 'POST' && !empty($_SESSION['user_id'])) {
    $first = trim($_POST['first_name'] ?? '');

    $stmt = $con->prepare('UPDATE users SET first_name = ? WHERE id = ?');
    $stmt->bind_param('si', $first, $_SESSION['user_id']);
    $stmt->execute();

    if ($stmt->affected_rows > 0) {
        $_SESSION['first_name'] = $first;
        header('Location: profile.php');
        exit;
    } else {
        // handle no-change or log $stmt->error
    }
}

Troubleshooting notes: confirm the session key used in WHERE is actually set and non-empty; log the bound values when debugging; check $stmt->error / $con->error; remove duplicate session_start(); and never call mysqli_fetch_assoc() on UPDATE/DELETE/INSERT results.

Recommended Answers

All 3 Replies

Member Avatar for rproffitt

To me your code does just what you wrote about. Think about the record set you are dealing at line 10 and then 11. It looks like you selected all records then issued an UPDATE which would replace all records in this set.

I don't see where you write what you really wanted to happen.

Member Avatar for dannette

You need a "WHERE".
"UPDATE user SET first_name ='" . $_POST['first_name'] . "' WHERE user_name='whatever'"
otherwise it will think you want to update everything in the first_name column.

Member Avatar for anand9796

You need to use where condtion on line 10, otherwise all records of the Database Table

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.