I have updated my database named as "Mohit sharma" but it gives output into database as first_name
: 0 and 'last_name`: Arora here is a pic http://postimg.org/image/jp2fy1yy7/
please help
here is my source code for form:
<div id="left_box"><br>
<img src="Images/general_setting.png" height="18" width="18"><a href="general_settings.php" style="text-decoration: none; color: #000000; font-family: Arial";> General</a><br><br>
<img src="Images/photo_setting.png" height="18" width="18"><a href="photo_settings.php" style="text-decoration: none; color: #000000; font-family: Arial";> Photos</a><br><br>
</div>
<div class="box">
<h1 style="font-family: consolas">Change your name</h1><hr>
<div id="change_name">
<label><strong>Your current name: </strong></label>
<?php
include('change_setting_db.php');
while($row = mysqli_fetch_array($result))
{
echo "(".$row['id'].") ".$row['first_name']." ".$row['last_name'];
}
?>
<br>
<br>
<form method="post" action="do_update_name.php">
<input type="hidden" name="id" value="<?php echo $row['id'];?>">
<label><strong>First name: </strong></label>
<input type="text" name="first_name" value="<?php echo $row['first_name'];?>">
<label><strong>Last name: </strong></label>
<input type="text" name="last_name" value="<?php echo $row['last_name'];?>">
<input type="submit" value="Submit">
</form>
</div>
</div>
and here is my source code for do_update_name.php
..
<?php
$firstname=$_POST['first_name'];
$lastname=$_POST['last_name'];
$id=$_POST['id'];
$con=mysqli_connect("localhost","root","Bhawanku", "members");
// Check connection
if (mysqli_connect_errno())
{
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
$update =mysqli_query($con,"UPDATE admin SET first_name='$firstname' AND last_name='$lastname' WHERE id='$id' ");
if($update){
echo "Successfully created!!";
}
?>
You're wide open to sql injection, as I stated before.
Your statement looks like that:
UPDATE admin SET first_name='$firstname' AND last_name='$lastname' WHERE id='$id' "
I think you want to use a comma instead of the AND
:
UPDATE admin SET first_name='$firstname', last_name='$lastname' WHERE id='$id' "
If you're a beginner, please don't put effort in deprecated language-parts like the mysql_ extension. Learn to do it right, just from the beginning. Use mysqli or PDO with prepared statements and bind your inputs to parameters.