0

I have been working on this Login script for awhile and everything works, except this update function. I have tried changing variable name and everything else. On UpdateUser.php, the code works if I insert variables instead of the $[POST] variables. I am at a loss. Any help would be greatly appreciated. Sorry for the messy code, this is a class assignment, so I wasn't worried about password security at the moment.

This is index4.php 

<form id="form" action="index4.php" method="post">
     <h2>Update Your Login</h2>
          UserName:<br>
               <input type="text" id="useuserName"  required />
            <br>
          Password:<br>
                <input type="text" id="usepassWord"  required />
            <br>
          First Name:<br>
                <input type="text" id="usefirstName" required />
            <br>
          Last Name:<br>
                <input type="text" id="uselastName" required />
            <br> 
                <input id="updateuser" type ="submit" />
        </form>
        <script>
            $('#updateuser').click(function() {
                var useID = $_SESSION["id"];
                var useuserName = $("#useuserName").val();
                var usepassWord = $("#usepassWord").val();
                var usefirstName = $("#usefirstName").val();
                var uselastName = $("#uselastName").val();
                var usePermissions = $_SESSION["Permissions"];
               $.ajax({ 
                    type : 'POST',
                    url  : '', 
                    data :{action:'updateuser', useID:useID, useuserName:useuserName, uselastName:uselastName, usePermissions:usePermissions},           
                    error: function (html) {
                            alert( "What the duck" );
                          },
                        });
                });
        </script>

This is the UpdateUser.php file 

<?php
    //Update
        if($_POST['action'] == 'updateuser'){
            //Set Variables
            $servername = "localhost";
            $username = "root";
            $password = "";
            $db = "userdb";

        //Create connection
         $conn = new mysqli($servername, $username, $password, $db);
            // Check connection
                if ($conn->connect_error) {
                    die("Connection: Failed! " . $conn->connect_error);
                } 
        //Actual Code
                $useID = $_POST['useID'];
                $useuserName = $_POST['useuserName'];
                $usepassWord = $_POST['usePassword'];
                $usefirstName = $_POST['usefirstName'];
                $uselastName = $_POST['uselastName'];
                $usePermissions = $_POST['usePermissions'];

            //Create Query
            $sql = "UPDATE users SET userName = '$useuserName', Pass = '$usepassWord', firstName = '$usefirstName', lastname = '$uselastName', Permissions = '$usePermissions'  WHERE id =" . $useID ."";


                //Did it work Check
                if ($conn->query($sql) === TRUE) {
                    echo "Cool";
                } else {
                    echo "What " . $conn->error;
                }

        //Close Out
            $conn->close();
    }
    ?>
Sarah Durden
  • 1
  • 1
  • **Never** store plain text passwords. You should use [`password_hash()`](http://us3.php.net/manual/en/function.password-hash.php) and [`password_verify()`](http://us3.php.net/manual/en/function.password-verify.php) instead. If you're using a version of PHP prior to 5.5, do **not** use MD5 or SHA1 to hash passwords. Instead you can use [this compatibility pack](https://github.com/ircmaxell/password_compat). – Alex Howansky May 05 '17 at 16:29
  • Your code is vulnerable to [**SQL injection**](https://en.wikipedia.org/wiki/SQL_injection) attacks. You should use [**mysqli**](https://secure.php.net/manual/en/mysqli.prepare.php) or [**PDO**](https://secure.php.net/manual/en/pdo.prepared-statements.php) prepared statements with bound parameters as described in [**this post**](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php). – Alex Howansky May 05 '17 at 16:29

0 Answers0