PHP Benutzerinformationen bearbeiten

<?php # Script 10.3 - edit_user.php
// This page is for editing a user record.
// This page is accessed through view_users.php.
$page_title = &#39;Edit a User&#39;;
echo &#39;<h1>Edit a User</h1>&#39;;
// Check for a valid user ID, through GET or POST:
if ( (isset($_GET[&#39;id&#39;])) && (is_numeric($_GET[&#39;id&#39;])) ) { // From view_users.php
$id = $_GET[&#39;id&#39;];
} elseif ( (isset($_POST[&#39;id&#39;])) && (is_numeric($_POST[&#39;id&#39;])) ) { // Form submission.
$id = $_POST[&#39;id&#39;];
} else { // No valid ID, kill the script.
echo &#39;<p class="error">This page has been accessed in error.</p>&#39;;
exit();
}
require (&#39;c.php&#39;);聽
// Check if the form has been submitted:
if ($_SERVER[&#39;REQUEST_METHOD&#39;] == &#39;POST&#39;) {
$errors = array();
// Check for a first name:
if (empty($_POST[&#39;first_name&#39;])) {
$errors[] = &#39;You forgot to enter your first name.&#39;;
} else {
$fn = mysqli_real_escape_string($dbc, trim($_POST[&#39;first_name&#39;]));
}
// Check for a last name:
if (empty($_POST[&#39;last_name&#39;])) {
$errors[] = &#39;You forgot to enter your last name.&#39;;
} else {
$ln = mysqli_real_escape_string($dbc, trim($_POST[&#39;last_name&#39;]));
}
// Check for an email address:
if (empty($_POST[&#39;email&#39;])) {
$errors[] = &#39;You forgot to enter your email address.&#39;;
} else {
$e = mysqli_real_escape_string($dbc, trim($_POST[&#39;email&#39;]));
}
if (empty($errors)) { // If everything&#39;s OK.
//聽 Test for unique email address:
$q = "SELECT user_id FROM user WHERE email=&#39;$e&#39; AND user_id != $id";
$r = @mysqli_query($dbc, $q);
if (mysqli_num_rows($r) == 0) {
// Make the query:
$q = "UPDATE user SET first_name=&#39;$fn&#39;, last_name=&#39;$ln&#39;, email=&#39;$e&#39; WHERE user_id=$id LIMIT 1";
$r = @mysqli_query ($dbc, $q);
if (mysqli_affected_rows($dbc) == 1) { // If it ran OK.
// Print a message:
echo &#39;<p>The user has been edited.</p>&#39;;} else { // If it did not run OK.
echo &#39;<p class="error">The user could not be edited due to a system error. We apologize for any inconvenience.</p>&#39;; // Public message.
echo &#39;<p>&#39; . mysqli_error($dbc) . &#39;<br />Query: &#39; . $q . &#39;</p>&#39;; // Debugging message.
}
} else { // Already registered.
echo &#39;<p class="error">The email address has already been registered.</p>&#39;;
}
} else { // Report the errors.
echo &#39;<p class="error">The following error(s) occurred:<br />&#39;;
foreach ($errors as $msg) { // Print each error.
echo " - $msg<br />\n";
}
echo &#39;</p><p>Please try again.</p>&#39;;
} // End of if (empty($errors)) IF.
} // End of submit conditional.
// Always show the form...
// Retrieve the user&#39;s information:
$q = "SELECT first_name, last_name, email FROM user WHERE user_id=$id";$r = @mysqli_query ($dbc, $q);
if (mysqli_num_rows($r) == 1) { // Valid user ID, show the form.
// Get the user&#39;s information:
$row = mysqli_fetch_array ($r, MYSQLI_NUM);
// Create the form:
echo &#39;<form action="edit_user.php" method="post">
<p>First Name: <input type="text" name="first_name" size="15" maxlength="15" value="&#39; . $row[0] . &#39;" /></p>
<p>Last Name: <input type="text" name="last_name" size="15" maxlength="30" value="&#39; . $row[1] . &#39;" /></p>
<p>Email Address: <input type="text" name="email" size="20" maxlength="60" value="&#39; . $row[2] . &#39;"聽 /> </p>
<p><input type="submit" name="submit" value="Submit" /></p>
<input type="hidden" name="id" value="&#39; . $id . &#39;" />
</form>&#39;;
} else { // Not a valid user ID.
echo &#39;<p class="error">This page has been accessed in error.</p>&#39;;
}
mysqli_close($dbc);
?>