How to insert into specific row in database?

Question

Okay, so my database is as follows by this order:

id (primary - auto_increment), username (unique), password, fname, mail

I have it so that users register a username and password and it adds it to the database, first of all. No username can be the same, and when it does add the data to the database it auto increments the ID. All of that works, but now I made an account settings page in which the user can change their email and first name, but it isn't working. I have the user enter variables in a form on one page, and it posts their first name as ufname (for update first name) and umail (for update mail). Then on the next page which updates the database I have this code:

session_start();
if(!isset($_SESSION['userId'])) {
die("&nbsp;You are not signed in. Please <a href='login.php'>click here</a> to sign in.");
} else {
$changeTXT = $_SESSION['username'];
$changeTXT = strtolower($changeTXT);
$changeTXT = ucfirst($changeTXT);
echo "Account Settings: <font color='red'>" . $changeTXT . "</font><br /><br />";

$ufname = $_POST['ufname'];
$umail = $_POST['umail'];

mysql_connect("localhost", "root", "sp1151") or die(mysql_error());


mysql_select_db("usersys") or die(mysql_error());

mysql_query("INSERT INTO userdb (id, username, password, fname, mail) VALUES('','','','$ufname', '$umail') ");


echo $umail . "<br /><br />";
echo $ufname;

}

Oh, I also have the users logged in on sessions too.

But how would I insert the first name and e-mail the user enters into their specific row on the database? My database name is userdb.

Answer 1

Have you considered using the Sql UPDATE?

Answer 2

You need to run an UPDATE query to alter an existing row, not an INSERT.

$sql = "UPDATE userdb SET fname = '$ufname', mail = '$umail' WHERE id = $id";
mysql_query($sql);

Answer 3

mysql_query("UPDATE userdb SET fname = '$ufname', umail = '$umail' WHERE id = '$_SESSION['userId']' ");

Answer 4

Update 'tableName' set 'columnName' = 'newEntry' where 'rowID' = 'value'.

Answer 5

You need to do use and UPDATE statement instead of an INSERT:

UPDATE userdb SET fname = ?, mail = ? WHERE username = ?;

That aside you should seriously consider using prepared statements with query parameters to prevent SQL injection attacs.