Can't update data in mysql from php

Question

This is my admin_edit.php code. I already checked others php file and found no problem. This code has no errors but it can't update data in database.

<?php require_once('header.php'); ?>
<?php
if($_GET && !$_POST)
{
if(isset($_GET['id']) && is_numeric($_GET['id']))
{
    $id = $_GET['id'];
}
else
{
    $id = NULL;
}

if($id)
{
    $sql    = "SELECT * FROM tb_admin WHERE id_admin=$id";
    $query  = mysql_query($sql) or die(mysql_error());
    $hasil  = mysql_fetch_array($query) or die(mysql_error());
}
}
elseif($_POST)
{

$id = $_POST['id_admin'];
$nama = $_POST['nama'];
$username  = $_POST['username'];
$password = md5($_POST['password']);

if($nama=='' || $username=='' || $password=='')
{
    $error = 'Nama, Username dan Password diisi tidak boleh kosong';
}
else

    {
        $sql = "UPDATE tb_admin SET nama='$nama', username='$username', password='$password' WHERE id_admin='$id'";
        mysql_query($sql) or die(mysql_error());
        $_SESSION['PESAN'] = 'Berhasil merubah user !';
        refresh('admin.php');   
    }
}
?>

<form method="post" action="" enctype="multipart/form-data">
<fieldset>
    <legend> Ubah Admin </legend>
    <?php if(isset($error)) echo '<div class="control-group"><div class="alert alert-error">'.$error.'</div></div>';
     ?>
    <div>
            <label for="nama">Nama</label>
            <input id="nama" name="nama" class="span4" type="text" required="required" value="<?php echo $hasil['username']; ?>"/>
        </div>
    <div>
          <label for="username">Username</label>
          <input id="username" name="username" type="text" required="required" value="<?php echo $hasil['username']; ?>"/>
        </div>
    <div>
            <label for="password">Password</label>
            <input id="password" name="password" class="wide" type="password" required="required" value=""/>
        </div>

    <div class="form-actions">           

<button type="submit" name="submit" class="btn btn-primary" value="Edit">Simpan</button>

<button type="button" class="btn" onclick="javascript: if(confirm('Anda yakin untuk batal ?')) window.location.href='admin.php'; else return false; ">Batal</button>

<input name="id" type="hidden" value="<?php if(isset($_POST['id'])) echo $_POST['id']; else echo $hasil['id_admin'];?>">
    </div>
</fieldset>
</form>
<?php require_once('footer.php'); ?>

I researched this problem for almost half a day and found no solution. Sorry for my bad english.

Answer 1

You are using name="id" instead of name="id_admin" as well as $_POST['id']
instead of $_POST['id_admin']

Change

<input name="id" type="hidden" value="<?php if(isset($_POST['id'])) echo $_POST['id']; else echo $hasil['id_admin'];?>">

to

<input name="id_admin" type="hidden" value="<?php if(isset($_POST['id_admin'])) echo $_POST['id_admin']; else echo $hasil['id_admin'];?>"> 

Your WHERE clause depends on it.

WHERE id_admin='$id'

---

• Your present code is open to SQL injection.

• Use mysqli with prepared statements, or PDO with prepared statements.