0

I want that user update his own data by his user id. I don't want that it will be shown in url, so I tried to make it this way:

<?php
session_start();
if (isset($_SESSION['id'])){
    $userId = $_SESSION['id'];
}
else {
    header('Location: login_sys.php');
  die();
}

include_once('/var/www/html/private/db_credentials.php');
$db = mysql_connect ("$servername", "$username", "$password", "$dbname") or die("Kann nicht mit DB verbinden.!");

//Wenn eingegeben
if (isset ($_POST['submit'])) {
      $betrieb = $_POST['betrieb'];
    $anschrift = $_POST['ort'];
    $apartner = $_POST['apartner'];
    $praktika = $_POST['praktika'];
    //Was wurde eingegeben

    //
    $query = "UPDATE nutzer SET betrieb='$betrieb', ort='$ort', apartner='$apartner', praktika='$praktika' WHERE id='$userId' ";
    mysqli_query($db, $query, $sql);
}

?>

And here is the form:

<form action="bearbeitung_checker.php" method="POST">
  <div class="mdl-textfield mdl-js-textfield mdl-textfield--floating-label">
    <input class="mdl-textfield__input" type="text" id="sample3" name="betrieb">
    <label class="mdl-textfield__label" for="sample3">Betrieb...</label>
  </div>


<!-- Textfield with Floating Label -->


  <div class="mdl-textfield mdl-js-textfield mdl-textfield--floating-label">
    <input class="mdl-textfield__input" type="text" id="sample3" name="ort">
    <label class="mdl-textfield__label" for="sample3">Anschrift...</label>
  </div>


<!-- Textfield with Floating Label -->


  <div class="mdl-textfield mdl-js-textfield mdl-textfield--floating-label">
    <input class="mdl-textfield__input" type="text" id="sample3" name="apartner">
    <label class="mdl-textfield__label" for="sample3">Ansprech Partner...</label>
  </div>


<!-- Textfield with Floating Label -->

  <div class="mdl-textfield mdl-js-textfield mdl-textfield--floating-label">
    <input class="mdl-textfield__input" type="text" id="sample3" name="praktika">
    <label class="mdl-textfield__label" for="sample3">Praktika...</label>
  </div>

  <a></a><br>


<button class="mdl-button mdl-js-button mdl-button--raised mdl-js-ripple-effect mdl-button--accent" type="submit" id="submit" name="submit">
  Bearbeitung speichern
</button>

</form>

I don't know if I did something wrong here because I'm not getting 500 error.

I'll be happy if you could help me.

Kind regards,

Yan Malinovskiy

Yan Malinovskiy
  • 23
  • 6
  • 1
    1. **Don't** use the **deprecated and insecure** `mysql_*`-functions. They have been deprecated since PHP 5.5 (in 2013) and were completely removed in PHP 7 (in 2015). Use MySQLi or PDO instead. 2. **You are wide open to [SQL Injections](http://php.net/manual/en/security.database.sql-injection.php)** and should really use [Prepared Statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) instead of concatenating your queries, which can be used if you use the above mentioned MySQLi or PDO. – M. Eriksson Nov 25 '17 at 21:28
  • `mysqli_query($db, $query, $sql);` that isn't valid, nor is this `$db = mysql_connect ("$servername", "$username", "$password", "$dbname")` – Funk Forty Niner Nov 25 '17 at 21:32
  • what does this file `bearbeitung_checker.php` look like? – JeanPaul98 Nov 25 '17 at 21:32
  • _Side note:_ There's no reason to wrap variables in double quotes when you're passing them as function arguments. Instead of `("$servername", ...` just do `($servername, ...` etc. – M. Eriksson Nov 25 '17 at 21:34

0 Answers0