CODEWITHSUNDEEP
phpmysql
David Garcia
David Garcia

Reputation: 2696

PHP/MYSQL Update Statement advice

I have a form with user details and an update statement that will update such details if the user wants to, i added validation so that an email cannot be associated with another account hence the if($checkuser != 0)

The issue with the statement is that if the user doesn't change their email and updates their details, they will get an error saying email already exist.

I wanted to integrate after the email existence check something like else if(($_POST["myusername"]) == ($row['email'])) then continue updating.(myusername variable name contains the email) meaning that if the posted email is the same as their current email then continue updating.

But i am getting lost, since i am relatively new with PHP i am having trouble with parenthesis and brackets.

Here is my code

if($_POST['usubmit']=='Update') 
{
    $Uerr = array();

    if (!$_POST['fullname'] || !$_POST['myusername']) 
        {   
            $Uerr[] = '» Name or Email must be filled in!';
        }

    if (!checkEmail($_POST['myusername']))
        {
            $Uerr[]='» Your email is not valid!';
        }


    // If there are no errors
    if(!count($Uerr))
        {
            /* Now we will check if username is already in use or not */
           $queryuser=mysql_query("SELECT * FROM customer WHERE email='" . mysql_real_escape_string($_POST["myusername"]) . "'");
           $checkuser=mysql_num_rows($queryuser);

           if($checkuser != 0)
            { 
                $Uerr[]='» Sorry this email is already registered!';
            }

        else 
                {
                    $updateDetails = mysql_query("UPDATE customer SET 
                    name = '" . mysql_real_escape_string($_POST["fullname"]) . "', 
                    dob = '" . mysql_real_escape_string($_POST["dob"]) . "',  
                    address = '" . mysql_real_escape_string($_POST["address"]) . "', 
                    email = '" . mysql_real_escape_string($_POST["myusername"]) . "', 
                    telephone = '" . mysql_real_escape_string($_POST["telephone"]) . "' 
                    WHERE cus_id = '$cus_id'"); 

                    if ($updateDetails) 

                            $_SESSION['Umsg']['Ureg-success']="» Your details have been updated successfully!";

                       else { 
                              $Uerr[]='» error updating your account'.mysql_error(); 
                            }
                }
        }
            if(count($Uerr))
            {
                $_SESSION['Umsg']['Ureg-err'] = implode('<br />',$Uerr);
            }

    header("Location: account.php");
    exit;        
}

Upvotes: 1

Views: 159

Answers (4)

invisal
invisal

Reputation: 11171

I have a form with user details and an update statement that will update such details if the user wants to, i added validation so that an email cannot be associated with another account hence the The issue with the statement is that if the user doesn't change their email and updates their details, they will get an error saying email already exist.

Why don't you just check if there is existed email with another account except his account which can be solved with a few changes to your query.

$queryuser=mysql_query("SELECT * FROM customer WHERE email='" . 
mysql_real_escape_string($_POST["myusername"]) . "' AND cus_id!=" . intval($cus_id));

Upvotes: 2

AL-Kateb
AL-Kateb

Reputation: 2962

this should work

if($_POST['usubmit']=='Update') 
{
    $Uerr = array();

    if (!$_POST['fullname'] || !$_POST['myusername']) 
        {   
            $Uerr[] = '&raquo; Name or Email must be filled in!';
        }

    if (!checkEmail($_POST['myusername']))
        {
            $Uerr[]='&raquo; Your email is not valid!';
        }


    // If there are no errors
    if(!count($Uerr))
        {
            /* Now we will check if username is already in use or not */
           $queryuser=mysql_query("SELECT * FROM customer WHERE email='" . mysql_real_escape_string($_POST["myusername"]) . "' AND cus_id !=" . $cus_id(mysql_real_escape_string));

           $checkuser=mysql_num_rows($queryuser);

           if($checkuser != 0)
            { 
                $Uerr[]='&raquo; Sorry this email is already registered!';
            }

        else 
                {
                    $updateDetails = mysql_query("UPDATE customer SET 
                    name = '" . mysql_real_escape_string($_POST["fullname"]) . "', 
                    dob = '" . mysql_real_escape_string($_POST["dob"]) . "',  
                    address = '" . mysql_real_escape_string($_POST["address"]) . "', 
                    email = '" . mysql_real_escape_string($_POST["myusername"]) . "', 
                    telephone = '" . mysql_real_escape_string($_POST["telephone"]) . "' 
                    WHERE cus_id = '$cus_id'"); 

                    if ($updateDetails) 

                            $_SESSION['Umsg']['Ureg-success']="&raquo; Your details have been updated successfully!";

                       else { 
                              $Uerr[]='&raquo; error updating your account'.mysql_error(); 
                            }
                }
        }
            if(count($Uerr))
            {
                $_SESSION['Umsg']['Ureg-err'] = implode('<br />',$Uerr);
            }

    header("Location: account.php");
    exit;        
}

Upvotes: 2

user745235
user745235

Reputation:

I do something ugly but works great.

I add the actual info on some hidden inputs like:

<input type="hidden" name="actual_email" value="<?php echo $object->email; ?>" />

Now you just need to check if the email on the user input (the visible one) is the same on the hidden input, if yes, just ignore the email validation because it means the user hasn't changed his email.

Upvotes: 1

Quest4Answers
Quest4Answers

Reputation: 88

When you are having a user change their information, they should only have access to their account (for security & privacy purposes). Therefore you should use their e-mail as the identifier when getting their information.

Upvotes: 0

Related Questions