update table with prepared statement

Question

I'm trying to update my cards table. After the user selects the "update" button it redirects him to the update page where he can see and modify his datas. the problem is, that input fields don't load his datas and also can't update them for some reason. Here's the button on the first page:

<a href="update.php?id=<?php echo $record['id']; ?>" class="btn btn-succes" role="button">Edit</a>

and here's the update page:

<?php
session_start();
define('DB_SERVER', 'localhost');
define('DB_USERNAME', 'root');
define('DB_PASSWORD', '');
define('DB_NAME', 'reg');

/* Attempt to connect to MySQL database */
$mysqli = mysqli_connect(DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_NAME);

// Check connection
if($mysqli === false){
    die("HIBA: Nem sikerült csatlakozni. " . mysqli_connect_error());
}

$stmt = $mysqli -> prepare('UPDATE cards SET name=?, phone=?, phone2=?, email=?, zipcode=?, address=?, job=?, description=?, visibility=?, confirmed=?, userid=?  WHERE id = ?');



if (
    $stmt &&
    $stmt->bind_param('ssssisssiiii', $name, $phone, $phone2, $email, $zipcode, $address, $job, $description, $visibility, $confirmed, $userid, $id)
    &&
    $stmt -> execute() &&
    $result = mysqli_query($mysqli,"SELECT * FROM cards WHERE id='$id'") &&
    $result = $stmt -> get_result() 
) {

        $id = $row['id'];
        $name = $row['name'];
        $phone = $row['phone'];
        $phone2 = $row['phone2'];
        $email = $row['email'];
        $zipcode = $row['zipcode'];
        $address = $row['address'];
        $job = $row['job'];
        $description = $row['description'];
        $userid = $_SESSION['userid'];
        echo 'Updated';
    }

 else {
    echo $mysqli -> error;
}
?>
 <form action="update.php" method="post">
<table cellpadding="10" cellspacing="0" width="500" class="tblSaveForm">
<tr class="header">
<td colspan="2">Edit Card</td>
</tr>
<tr>
<td><label>Username</label></td>
<td><input type="text" name="name" class="txtField" value="<?php echo $result['name']; ?>">
</tr>
<tr>
<td><label>phone</label></td>
<td><input type="text" name="phone" class="txtField" value="<?php echo $result['phone']; ?>"></td>
</tr>
<td><label>phone2</label></td>
<td><input type="text" name="phone2" class="txtField" value="<?php echo $result['phone2']; ?>"></td>
</tr>
<tr>
<td><label>email</label></td>
<td><input type="text" name="email" class="txtField" value="<?php echo $result['email']; ?>"></td>
</tr>
<tr>
<td><label>zipcode</label></td>
<td><input type="text" name="zipcode" class="txtField" value="<?php echo $result['zipcode']; ?>"></td>
</tr>
<tr>
<td><label>address</label></td>
<td><input type="text" name="address" class="txtField" value="<?php echo $result['address']; ?>"></td>
</tr>
<tr>
<td><label>job</label></td>
<td><input type="text" name="job" class="txtField" value="<?php echo $result['job']; ?>"></td>
</tr>
<tr>
<td><label>description</label></td>
<td><input type="text" name="description" class="txtField" value="<?php echo $result['description']; ?>"></td>
</tr>
<tr>
<td colspan="2"><input type="submit" name="submit" value="Submit" class="buttom"></td>
</tr>
</table>
</form>

and here's where datas coming from:

 $stmt = $conn->prepare("SELECT id, name, phone, phone2, email, zipcode, address, job, description, visibility, confirmed, userid FROM cards WHERE userid= ?");
          $stmt->bind_param("i",$userid);
          $userid = (int) $_SESSION['id'];
          $stmt->execute();
          $result = $stmt->get_result();

            while( $record = mysqli_fetch_assoc($result) ) {
            ?>

            <div class="col-md-4">
              <div class="card card-profile">
                <div class="card-avatar">
                  <a href="#">
                  <img class="img" src="assets/img/faces/avatar.png" />
                  </a>
                </div>
                <div class="card-body">
                  <div class="card-top">
                  <h4 class="card-category text-gray"><b><?php echo $record['job']; ?></b><br>
                    <span style="color: black;"><?php echo $record['name']; ?></span></h4>
                  </div>
                  <hr>
                  <h5 class="card-description">
                  <i class="material-icons">
                      mobile_friendly
                      </i>
                      <b>tel.:</b> <?php echo $record['phone']; ?>
                    </h5>
                    <h5 class="card-description"  <?php if(empty($record['phone2'])){echo " style='display: none';"; }?>>
                  <i class="material-icons">
                      mobile_friendly
                      </i>
                      <b>tel2.:</b> <?php echo $record['phone2']; ?>
                    </h5>
                    <h5 class="card-description" <?php if(empty($record['email'])){echo " style='display: none';"; }?>>
                      <i class="material-icons">
                        email
                        </i>
                        <b> E-mail:</b> <?php echo $record['email']; ?>
                    </h5>
                    <h5 class="card-description" <?php if(empty($record['address'])){echo " style='display: none';"; }?>>
                        <i class="material-icons">
                            location_on
                            </i>
                          <b> Cím:</b> <?php echo $record['address']; ?>
                      </h5>
                    <h5 class="card-description">
                        <b> Leírás:</b> <?php echo $record['description']; ?>
                    </h5>
                    <div class="card-buttons">
                  <form action="" method="POST" onsubmit="return confirm('Biztosan törölni szeretné?');">
                     <input value="<?php echo $record['id']; ?>" name="id" style="display: none;">
                     <a href="update.php?id=<?php echo $record['id']; ?>" class="btn btn-succes" role="button">Edit</a>
                     <button type="submit" class="btn btn-danger" name="reject" id="update" style="background-color: red;">Törlés</button>

                  </form>

Answer 1

You're missing the code that puts the user input into all the variables that are used in the UPDATE statement. And the update should only be used when the form is submitted, not when you're initially displaying the form.

You need to put the id into the URL in the action attribute of the form, so it knows which ID to update.

<?php
session_start();
define('DB_SERVER', 'localhost');
define('DB_USERNAME', 'root');
define('DB_PASSWORD', '');
define('DB_NAME', 'reg');

/* Attempt to connect to MySQL database */
$mysqli = mysqli_connect(DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_NAME);

// Check connection
if($mysqli === false){
    die("HIBA: Nem sikerült csatlakozni. " . mysqli_connect_error());
}

$id = $_GET['id'];

if (isset($_POST['submit'])) {
    $name = $_POST['name'];
    $phone = $_POST['phone'];
    $phone2 = $_POST['phone2'];
    $email = $_POST['email'];
    $zipcode = $_POST['zipcode'];
    $address = $_POST['address'];
    $job = $_POST['job'];
    $description = $_POST['description'];
    $visibility = $_POST['visibility'];
    $confirmed = $_POST['confirmed'];
    $userid = $_POST['userid'];

    $stmt = $mysqli -> prepare('UPDATE cards SET name=?, phone=?, phone2=?, email=?, zipcode=?, address=?, job=?, description=?, visibility=?, confirmed=?, userid=?  WHERE id = ?');

    if (
        $stmt &&
        $stmt->bind_param('ssssisssiiii', $name, $phone, $phone2, $email, $zipcode, $address, $job, $description, $visibility, $confirmed, $userid, $id) &&
        $stmt -> execute()
        ) {
        echo 'Updated';
    } else {
        echo $mysqli -> error;
    }
} 

$getstmt = $mysql->prepare("SELECT * FROM cards WHERE id= ?");
if ($getstmt and
    $getstmt->bind_param('i', $id) and
    $getstmt->execute() and
    $result = $getstmt->get_result() and
    $row = $result->fetch_assoc()
    ) {

    $id = $row['id'];
    $name = $row['name'];
    $phone = $row['phone'];
    $phone2 = $row['phone2'];
    $email = $row['email'];
    $zipcode = $row['zipcode'];
    $address = $row['address'];
    $job = $row['job'];
    $description = $row['description'];
    $userid = $_SESSION['userid'];


    ?>
    <form action="update.php?id=<?php echo $id; ?>" method="post">
    <table cellpadding="10" cellspacing="0" width="500" class="tblSaveForm">
    <tr class="header">
    <td colspan="2">Edit Card</td>
    </tr>
    <tr>
    <td><label>Username</label></td>
    <td><input type="text" name="name" class="txtField" value="<?php echo $name; ?>"></td>
    </tr>
    <tr>
    <td><label>phone</label></td>
    <td><input type="text" name="phone" class="txtField" value="<?php echo $phone; ?>"></td>
    </tr>
    <td><label>phone2</label></td>
    <td><input type="text" name="phone2" class="txtField" value="<?php echo $phone2; ?>"></td>
    </tr>
    <tr>
    <td><label>email</label></td>
    <td><input type="text" name="email" class="txtField" value="<?php echo $email; ?>"></td>
    </tr>
    <tr>
    <td><label>zipcode</label></td>
    <td><input type="text" name="zipcode" class="txtField" value="<?php echo $zipcode; ?>"></td>
    </tr>
    <tr>
    <td><label>address</label></td>
    <td><input type="text" name="address" class="txtField" value="<?php echo $address; ?>"></td>
    </tr>
    <tr>
    <td><label>job</label></td>
    <td><input type="text" name="job" class="txtField" value="<?php echo $job; ?>"></td>
    </tr>
    <tr>
    <td><label>description</label></td>
    <td><input type="text" name="description" class="txtField" value="<?php echo $description; ?>"></td>
    </tr>
    <tr>
    <td colspan="2"><input type="submit" name="submit" value="Submit" class="buttom"></td>
    </tr>
    </table>
    </form>
} else {
    echo $mysqli->error;
}