PHP Member Profile Update with Prepared Statements

Update only approved profile fields

Identify the member from the authenticated session, validate each editable field on the server, and use a prepared statement. Do not accept a member ID from a hidden form field as proof that the user may update that account.

<?php
session_start();
$memberId = $_SESSION['member_id'] ?? 0;
$name = trim($_POST['name'] ?? '');
$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);

if ($memberId < 1 || $name === '' || !$email) {
    exit('Invalid profile data.');
}

$stmt = $pdo->prepare(
    'UPDATE members
     SET name = :name, email = :email
     WHERE id = :id'
);
$stmt->execute([
    ':name' => $name,
    ':email' => $email,
    ':id' => $memberId,
]);
?>

After updating, escape values with htmlspecialchars() when they are rendered into HTML. Add a CSRF token to the form and enforce uniqueness rules for fields such as email addresses at the database level.

Legacy examples below: treat older direct-input SQL patterns as historical reference only.

In membership management script there will be an area where members can add changes to their profile. Here the profile can be updated by the member after they login to the system. Update profile feature can be extended with different features like email is to be validated once it is changed etc. Here we will only see the basic requirement of any update profile script.

Update profile by user in PHP MySQL with selection of radio buttons and text box

The present script will take care of change in name, email address and sex ( for our learning only we have given this option). You can see that for the sex we have used one period button so we will see how by default the selection of period button is done by collecting the old details of the user.

The script first collects the details of the user from the table and uses them as default value. The member can check them and add the necessary changes to it. On submit by the member the data will be updated on the table against the user. We have given sufficient comments within the script for easy understanding. You can use the PHP forum to discuss your bugs , improvements and other problems.

Here is the form for update profile

Update Profile
Email
Name
Sex	Male Female

Here is the processing code and you can download the code at the end of this page.

We will start with collecting the form data and checking the session of the user.

require "check.php";

$todo=$_POST['todo'];
$name=$_POST['name'];
$email=$_POST['email'];
$sex=$_POST['sex'];
// check the login details of the user and stop execution if not logged in

if(isset($todo) and $todo=="update-profile"){

// set the flags for validation and messages
$status = "OK";
$msg="";

// if name is less than 5 char then status is not ok
if (strlen($name) < 5) {
$msg=$msg."Your name  must be more than 5 char length<BR>";
$status= "NOTOK";}	

// you can add email validation here if required. 
// The code for email validation is available at www.plus2net.com

if($status<>"OK"){ // if validation failed
echo "<font face='Verdana' size='2' color=red>$msg</font><br><input type='button' value='Retry' onClick='history.go(-1)'>";
}else{ // if all validations are passed.
//////////////////////////////////////////////////////////
$sql=$dbo->prepare("update plus_signup set name=:name,email=:email,sex=:sex where userid='$_SESSION[userid]'");
$sql->bindParam(':name',$name,PDO::PARAM_STR, 25);
$sql->bindParam(':email',$email,PDO::PARAM_STR, 15);
$sql->bindParam(':sex',$sex,PDO::PARAM_STR, 7);
if($sql->execute()){
echo "<font face='Verdana' size='2' color=green>You have successfully updated your profile<br></font>";
}// End of if profile is ok 
else{
print_r($sql->errorInfo()); // if any error is there it will be posted
$msg=" <font face='Verdana' size='2' color=red>There is some problem in updating your profile. Please contact site admin<br></font>";
}// end of if else if database updation failed
}// end of if else for satus<> ok
echo $msg;
}// end of todo to check form inputs

Download PHP Membership Management Script Add / Update profile photo
Change Password Script Login Script PHP Signup Login / Logout script

Scripts

Subhendu Mohapatra

Author & Instructor at plus2net

I write and maintain practical tutorials on Python, PHP, SQL, JavaScript, HTML, jQuery, and web development at plus2net. The tutorials focus on clear explanations, working examples, and code that readers can test and adapt while learning.

About the author Watch on YouTube

Connect:

Subscribe to our YouTube Channel here

This article is written by plus2net.com team. https://www.plus2net.com

plus2net.com

vicky	24-10-2013
it's nice and great and exactly what i am looking for, i am suggesting about including profile picture for user if you could do that it would be great to see.

Chinedum	07-03-2018
The download link for the script is not on the page.

Jamie	09-04-2018
This was exactly what i was looking for. Im hoping to take your system and modify it for a game i am building. Its just so tricky to handle user management.

smo1234	14-02-2019
This is part of Membership management script. Download link at the end of the page is there.

Update a Member Profile Securely in PHP

Update only approved profile fields

Subhendu Mohapatra