Is there a specific requirement that states what the pool of characters used must be?
If not, then why use PHP at all? Let MySQL create the random values for you, e.g.:
UPDATE Users SET Unique_ID = LEFT(MD5(UUID()), 12)
Otherwise, the reason every user gets updated with the same value is because that's exactly what you're telling MySQL to do; after the for() loop runs, you're only using the last value in $id to issue a single UPDATE query (one without a WHERE clause, meaning it will be applied to all rows in the table).
EDIT: Also, despite the extremely small possibility of duplicate IDs being generated (especially given the small sample size), I do hope you've still added a UNIQUE index/constraint on that column to ensure the values are indeed unique.