在输入/回显行中标记PHP表单字段

Question

I have this code from my site http://www3.londonmet.ac.uk:8008/~iia0014/userdetails.php

I wanted to know how to correctly format the form nicely giving names for the fields in the same line I echo the database rows so it is clear what is what. For example, I tried:

<input value="<?php echo "ID: " . $row["id"]; ?>"><br>

What should I add or remove to make the above line work properly showing: ID: Some id here?

but this concatenated the ID word with the row id itself, inserting the "ID: " inside the form and I wanted it to be outside nicely. I can add a table to the form and give a name for the th's... But is it the only way? Can I just do it the easy way, all in one line to make my code clearer? Plus, can I incorporate the delete and update buttons in an easier way as well, instead of writing a function separately, perhaps a new function on the same line? I am looking for a cleaner code with the least number of lines.

<?php session_start(); ?>
<?php include "includes/connection.php"; ?>

<?php

$query = mysql_query("SELECT id, username, password, email, name, aim, admin, time,          phone, address
FROM users 
WHERE username = '".$_SESSION['myusername']."' ");


while($row = mysql_fetch_array($query) ) 
{ 

?>

<input value="<?php echo $row["id"]; ?>"><br>
<input value="<?php echo $row["username"];  ?> "><br>
<input value="<?php echo $row['password'];  ?> "><br>
<input value="<?php echo $row['email'];  ?> "><br>
<input value="<?php echo $row['name'];  ?> "><br>
<input value="<?php echo $row['aim'];  ?> "><br>
<input value="<?php echo $row['admin'];  ?> "><br>
<input value="<?php echo $row['time'];  ?> "><br>
<input value="<?php echo $row['phone'];  ?> "><br>
<input value="<?php echo $row['address'];  ?> "><br>

<?php 
}
?>

Answer 1

You can do a few things:

For your initial query,

$myusername = $_SESSION['myusername'];
$query = mysql_query("SELECT id, username, password, email, name, aim, admin, time,          phone, address FROM users WHERE username = '$myusername' ");

This is not meant for a production environment, but since you're learning it's always good to have things separated so you can better understand what is going on.

If the user edits their information (update the db), you could make a form with a single button inside it, method=post and action=database.php?action=edit. And inside database.php,

if(isset($_GET['action']) == 'edit') { 

// set all posted values to variables
// run the update query... UPDATE ... WHERE username = '$myusername'

} 

For the delete, make another form with another single button, similarly: action=database.php?action=delete. And inside database.php,

if(isset($_GET['action']) == 'delete') { 

// run the delete query... DELETE FROM $tbl WHERE username = '$myusername'

} 

Answer 2

You don't have to put everything in the same line, less lines isn't always better.
About the input field, your code should be something like:

<label>ID</label>
<input type="text" name="id" value="<?php echo $row['id']; ?>">

And by the way, in php, single quotes are for strings, double quotes are for strings and variables(maybe not the right technical definition). So when you concatenate, you should do: 'string '.$var; instead of "string ".$var .
And when you are echoing, you should use commas to 'join' strings and variables, so you are parsing parameters to the echo function instead of concatenating. This is faster because it outputs the data directly. Unlike concatenating, which joins the string first and then outputs it. So it would be echo 'string ', $var .
Also, when you are using double quotes, it's faster to use {$var} for variables. For example:

mysql_query("SELECT `name` FROM `table` WHERE `id`='{$_SESSION['id']}'");

Note that in mysql queries, fields and tables are written between grave accents ( ` ) , and values between single quotes ( ' ) .

Now back to your code. If all the input fields are going to be the same type, lets say type="text" , then you can do this:

while ($row = mysql_fetch_array($query)) {
    foreach ($row as $key => $value) {
        echo
       "<div>
            <label>{ucfirst($key)}</label>
            <input type="text" name="{$key}" value="{$value}">
        </div>";
    }
}

ucfirst()

Returns a string with the first character of str capitalized, if that character is alphabetic.

And for the update and delete buttons you can put two buttons with different name attributes:

 <input type="submit" name="update" value="Update"> <input type="submit" name="delete" value="Delete"> 

And then check if isset() .

 if (isset($_POST['update'])) { //update data } else if (isset($_POST['delete'])) { //delete data } 

And always remember to sanitize user inputs:

 function sanitize($str) { return mysql_real_escape_string(htmlspecialchars(trim(stripslashes($str)))); } 

And instead of sanitizing one by one you can:

 $data = array_map('sanitize', $_POST);