<?php
}

include('formsubmit/editdataconfig.php');

// check if the form has been submitted. If it has, process the form and save it to the database
if (isset($_POST['submit']))
{
// confirm that the 'id' value is a valid integer before getting the form data
if (is_numeric($_POST['memberid']))
{
// get form data, making sure it is valid
$memberid = $_POST['memberid'];
$username = mysql_real_escape_string(htmlspecialchars($_POST['username']));
$password = mysql_real_escape_string(htmlspecialchars($_POST['password']));
$level = mysql_real_escape_string(htmlspecialchars($_POST['level']));
$name = mysql_real_escape_string(htmlspecialchars($_POST['name']));
$emailaddress = mysql_real_escape_string(htmlspecialchars($_POST['emailaddress']));
$country = mysql_real_escape_string(htmlspecialchars($_POST['country']));
$phonenumber = mysql_real_escape_string(htmlspecialchars($_POST['phonenumber']));

// check that firstname/lastname fields are both filled in
if ($username == '' || $password == '' || || $level == '' || $name == '' || $emailaddress == '' || $country == '' || $phonenumber == '')
{
// generate error message
$error = 'ERROR: Please fill in all required fields!';

//error, display form
renderForm($memberid, $username, $password, $level, $name, $emailaddress, $country, $phonenumber, $error);
}
else
{
// save the data to the database
mysql_query("UPDATE userdata SET username='$username', password='$password', level='$level', name='$name', emailaddress='$emailaddress', country='$country', phonenumber='$phonenumber' WHERE memberid='$memberid'")
or die(mysql_error());

// once saved, redirect back to the view page
header("Location: http://localhost/Cay Final/admin/editmembersdata=success.php"); }
}
else
{
// if the 'id' isn't valid, display an error
echo 'Error!';
}
}
else
// if the form hasn't been submitted, get the data from the db and display the form
{

// get the 'id' value from the URL (if it exists), making sure that it is valid (checing that it is numeric/larger than 0)
if (isset($_GET['memberid']) && is_numeric($_GET['memberid']) && $_GET['memberid'] > 0)
{
// query db
$memberid = $_GET['memberid'];
$result = mysql_query("SELECT * FROM userdata WHERE memberid=$memberid")
or die(mysql_error());
$row = mysql_fetch_array($result);

// check that the 'id' matches up with a row in the databse
if($row)
{

// get data from db
$username = $row['username'];
$password = $row['password'];
$level = $row['level'];
$name = $row['name'];
$emailaddress = $row['emailaddress'];
$country = $row['country'];
$phonenumber = $row['phonenumber'];

// show form
renderForm($memberid, $username, $password, $level, $name, $emailaddress, $country, $phonenumber, '');
}
else
// if no match, display result
{
echo "No results!";
}
}
else
// if the 'id' in the URL isn't valid, or if there is no 'id' value, display an error
{
echo 'Error!';
}
}
?>