update profiles: UserID(mysql)

[kikki]

I'm trying to do users profiles, form is created and everything, I need help adding logged in user's information to the database, the real problem is users profile information is saving on the same row 🙁

I've given own ID to every single users, but how to update the profile information to Logged in user's ID and view saved data information by userID?

<?php
$username = $session->username;
$email = $session->userinfo['email'];
$userid = $session->userinfo['userid'];

//connect
include 'config.php';

//insert, I think here I have to set userid somehow...
if($_POST['submit'] == "Send")
{
     $insert = mysql_query("INSERT INTO profiles (email, username, firstname, lastname, gender, location, birthday, ip, city, occupation, homepage, phone, address, icq, msn, yahoo, interests) VALUES('$email', '$username','$fname', '$lname', '$genderx', '$location', '$birthday', '$ip', '$city', '$occupation', '$homepage', '$phone', '$address', '$icq', '$msn', '$yahoo', '$interests')");

}

$query = mysql_query("SELECT * FROM profiles");

$row = mysql_fetch_array($query);
$username =  $row['username'];
$firstname = $row['firstname'];
$lastname = $row['lastname'];
$email = $row['email'];
$gender = $row['gender'];
$location = $row['location'];
$birthday = $row['birthday'];
$city = $row['city'];
$occupation = $row['occupation'];
$homepage = $row['homepage'];
$phone = $row['phone'];
$address = $row['address'];
$icq = $row['icq'];
$msn = $row['msn'];
$yahoo = $row['yahoo'];
$interests = $row['interests'];

//echo to check if this really works..
echo("$username, $firstname $lastname, $email, $gender, $birthday, $location, $ip, $city, $occupation, $homepage, $phone, $address, $icq, $msn, $yahoo, $interests");

?>

please give me a hand on this one.

[devinemke]

if ($_POST['submit'] == 'Send')
{
	$result = mysql_query("INSERT INTO profiles SET
	email = '$email',
	username = '$username',
	firstname = '$fname',
	lastname = '$lname',
	gender = '$genderx',
	location = '$location',
	birthday = '$birthday',
	ip = '$ip',
	city = '$city',
	occupation = '$occupation',
	homepage = '$homepage',
	phone = '$phone',
	address = '$address',
	icq = '$icq',
	msn = $msn',
	yahoo = '$yahoo',
	interests = '$interests'");
}

$result = mysql_query('SELECT * FROM profiles WHERE userid = ' . mysql_insert_id());
$row = mysql_fetch_assoc($result);
print_r($row);

[kikki]

devinemke,
thanks for the fast reaply... 🙂

Your code gets the data from mysql and display them if the data is available, but it doesn't insert them into their fields for some reason... 🙁

[devinemke]

use [man]mysql_error[/man] to see what the problem is:

if ($_POST['submit'] == 'Send') 
{ 
    $result = mysql_query("INSERT INTO profiles SET 
    email = '$email', 
    username = '$username', 
    firstname = '$fname', 
    lastname = '$lname', 
    gender = '$genderx', 
    location = '$location', 
    birthday = '$birthday', 
    ip = '$ip', 
    city = '$city', 
    occupation = '$occupation', 
    homepage = '$homepage', 
    phone = '$phone', 
    address = '$address', 
    icq = '$icq', 
    msn = $msn', 
    yahoo = '$yahoo', 
    interests = '$interests'");

	if ($result) {echo 'INSERT OK<br>';}
	else {exit(mysql_error());}
} 

$result = mysql_query('SELECT * FROM profiles WHERE userid = ' . mysql_insert_id());
if ($result) {echo 'SELECT OK<br>';}
else {exit(mysql_error());}
$row = mysql_fetch_assoc($result); 
print_r($row);

[kikki]

This is the error I'm getting...
I've set the "interests" = varchar(100), is this a problem?

You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'my interests comes here'' at line 16

[devinemke]

run all of your vars thru [man]addslashes[/man] before feeding them to the INSERT query

[kikki]

Originally posted by devinemke
run all of your vars thru [man]addslashes[/man] before feeding them to the INSERT query

Still getting the same error 🙁

Code Modified:

<?php
$ip = $_SERVER['REMOTE_ADDR'];
$username = $session->username;
$email = $session->userinfo['email'];
$userid = $session->userinfo['userid'];

// Connect to the database and check to see if the connection is good.
include 'dbconfig.php';


// Let's assume there are only two fields in the database, both of which are varchar: firstname and lastname
if ($_POST['submit'] == 'Send') 
{ 
    $result = mysql_query("INSERT INTO profiles SET 
    email = addslashes('$email'),
    username = addslashes('$username'),
    firstname = addslashes('$fname'),
    lastname = addslashes('$lname'),
    gender = addslashes('$genderx'),
    location = addslashes('$location'),
    birthday = addslashes('$birthday'),
    ip = addslashes('$ip'),
    city = addslashes('$city'),
    occupation = addslashes('$occupation'),
    homepage = addslashes('$homepage'),
    phone = addslashes('$phone'),
    address = addslashes('$address'),
    icq = addslashes('$icq'),
    msn = addslashes('$msn'),
    yahoo = addslashes('$yahoo'),
    interests = addslashes('$interests')");

    if ($result) {echo 'INSERT OK<br>';}
    else {exit(mysql_error());}
} 

$result = mysql_query('SELECT * FROM profiles WHERE userid = ' . mysql_insert_id());
if ($result) {echo 'SELECT OK<br>';}
else {exit(mysql_error());}
$row = mysql_fetch_assoc($result); 
print_r($row);

?>

[devinemke]

Originally posted by kikki
Still getting the same error

because you are still not running the data thru addslashes. all you are doing is echoing the slashed data. let's back up. where are all these vars coming from? a form i assume?

[kikki]

Originally posted by devinemke
because you are still not running the data thru addslashes. all you are doing is echoing the slashed data. let's back up. where are all these vars coming from? a form i assume?

Yes, all those vars are coming from form, could you show me how to run the data throuh addslashes?

the example I saw was:

<?php
$str = "Is your name O'reilly?";

// Outputs: Is your name O\'reilly?
echo addslashes($str);
?> 

Note: Take a look at the source code now, It's been modified.. you had a typo on the $msn' part, It's shows the same error even though I fixed that...

[devinemke]

assuming your form is using POST method:

$_POST = array_map('addslashes', $_POST);

[kikki]

Originally posted by devinemke
assuming your form is using POST method:

$_POST = array_map('addslashes', $_POST);

[/B]

Hey, thanks mate, this seems to insert all the lines without any problem, but I'm able to insert new rows with the same information again again after inserting all the information to mysql. Also how to view those correct information by userid? 😕

This way I'm trying to insert the form information to the specific USERID[logged in user]. I'm getting error:

if ($_POST['submit'] == 'Send') 
{ 

$result = mysql_query("INSERT INTO profiles SET 
userid = '$userid',
email = '$email',
username = '$username',
firstname = '$fname',
lastname = '$lname',
gender = '$genderx',
location = '$location',
birthday = '$birthday',
ip = '$ip',
city = '$city',
occupation = '$occupation',
homepage = '$homepage',
phone = '$phone',
address = '$address',
icq = '$icq',
msn = '$msn',
yahoo = '$yahoo',
interests = '$interests' WHERE userid = $userid");

    if ($result) {echo 'INSERT OK<br>';}
    else {exit(mysql_error());}
} 

The error is:

You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE userid = fd6eb77e78bbaff02022f2d345c72931' at line 19