Why isnt My PHP code updating SQL

Question

Does anyone know why this PHP code isn't updating the column picturesit will update the rest of them but just not the pictures column it is to update users information So email address , password and picture I'm Quite new to PHP so I dont really know what to look for when im looking for Errors

    <?php 

    require("common.php"); 

    if(empty($_SESSION['user'])) 
    { 
        header("Location: login.php"); 

        die("Redirecting to login.php"); 
    } 

    if(!empty($_POST)) 
    { 
        if(!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) 
        { 
            die("Invalid E-Mail Address"); 
        } 

        if($_POST['email'] != $_SESSION['user']['email']['picture']) 
        { 
            $query = " 
                SELECT 
                    1 
                FROM users 
                WHERE 
                    email = :email
                    picture = :picture
            "; 

            $query_params = array( 
                ':email' => $_POST['email'] 
            ); 

            try 
            { 
                $stmt = $db->prepare($query); 
                $result = $stmt->execute($query_params); 
            } 
            catch(PDOException $ex) 
            { 
                die("Failed to run query: " . $ex->getMessage()); 
            } 

            $row = $stmt->fetch(); 
            if($row) 
            { 
                die("This E-Mail address is already in use"); 
            } 
        } 

        if(!empty($_POST['password'])) 
        { 
            $salt = dechex(mt_rand(0, 2147483647)) . dechex(mt_rand(0, 2147483647)); 
            $password = hash('sha256', $_POST['password'] . $salt); 
            for($round = 0; $round < 65536; $round++) 
            { 
                $password = hash('sha256', $password . $salt); 
            } 
        } 
        else 
        { 
            $password = null; 
            $salt = null; 
        } 

        $query_params = array( 
            ':email' => $_POST['email'], 
            ':user_id' => $_SESSION['user']['id'], 
            ':picture' => $_POST['picture'], 
        ); 

        if($password !== null) 
        { 
            $query_params[':password'] = $password; 
            $query_params[':salt'] = $salt; 
        } 

        $query = " 
            UPDATE users 
            SET 
                email = :email 
                picture = :picture
        "; 

        if($password !== null) 
        { 
            $query .= " 
                , password = :password 
                , salt = :salt 
            "; 
        } 

        $query .= " 
            WHERE 
                id = :user_id 
        "; 

        try 
        { 
            // Execute the query 
            $stmt = $db->prepare($query); 
            $result = $stmt->execute($query_params); 
        } 
        catch(PDOException $ex) 
        { 
            die("Failed to run query: " . $ex->getMessage()); 
        } 

        $_SESSION['user']['email']['picture'] = $_POST['email']; 

        header("Location: private.php"); 

        die("Redirecting to private.php"); 
    } 

?> 

Answer 1

Your missing a comma after :email in your UPDATE statement.

$query = " 
            UPDATE users 
            SET 
                email = :email 
                picture = :picture
        "; 

should be

$query = " 
        UPDATE users 
        SET 
            email = :email,  
            picture = :picture
    "; 

EDIT: In addition to this you are also missing a parameter in your first query:

        $query = " 
            SELECT 
                1 
            FROM users 
            WHERE 
                email = :email
                picture = :picture
        "; 

        $query_params = array( 
            ':email' => $_POST['email'] 
        ); 

Notice how you are only applying :email in your query paramaters, but your query is expecting both :email and :picture.

You either need to remove picture = :picture from the $query or add ':picture' => $_POST['picture'] to $query_params

Answer 2

You are missing a ,.

$query = " 
    UPDATE users 
    SET 
        email = :email 
        picture = :picture
";

You need to change it to

$query = " 
    UPDATE users 
    SET 
        email = :email, 
        picture = :picture
";