PDO in PHP not working

Question

Every time I click the button, the update does not work as expected. However, if I change the where id = 1 it works.

<?php 
        $x=$_GET['id'];
        require 'db.php';
        echo 'sqsas'.$x;
        $stmt=$conn->prepare("select * from tbluser where id=:id");
        $stmt->bindValue('id',$x);          
        $stmt->execute();


        if(isset($_POST['btnEdit']))
        {   
            $stmt=$conn->prepare('update tbluser set username = :un, password = :pw,email = :em where id=:id');
            $stmt->bindValue(':id',$x);
            $stmt->bindValue(':un',$_POST['txtUsername']);
            $stmt->bindValue(':pw',$_POST['txtPassword']);
            $stmt->bindValue(':em',$_POST['txtEmail']);
            $stmt->execute();
            //header("location:view.php");
        }   
    ?>

and here is the HTML form:

<?php while($row = $stmt->fetch(PDO::FETCH_OBJ)) {?>
<form method="post" action="edit.php">
                <table>
                    <tr>
                        <td>id:</td>
                        <td><?php echo $row->id; ?></td>
                    </tr>

                    <tr>
                        <td>Email:</td>
                        <td><input type="text" name="txtEmail" value="<?php echo $row->email; ?>" /></td>
                    </tr>

                    <tr>
                        <td>Username:</td>
                        <td><input type="text" name="txtUsername"  value="<?php echo $row->username; ?>" /></td>
                    </tr>
                    <?php } ?>
                    <tr>
                        <td>Password:</td>
                        <td><input type="text" name="txtPassword"  /></td>
                    </tr>

                    <tr>
                        <td>&nbsp;</td>
                        <td><input type="submit" name="btnEdit" value="SAVE CHANGES"  /></td>
                    </tr>
                </table>
            </form>

Answer 1

The reason the ID is not being passed to your PHP is because it is never declared as a form element. In your HTML, you simply echo it on the screen. I assume this is because you don't want the user to edit the ID, just the name, password and email. However, if you want that to be passed to the PHP script when the form is submitted, it has to be declared as a form element such as <input>. You can hide it to prevent the user from editing it, such as below:

<input type="hidden" name="id" value="<?php echo $row->id; ?>">

You can put this anywhere, since it will be hidden, but logically a good place to put it would be in the same <tr></tr> block that you use for displaying the ID.

Note: as Charlotte Dunois notes in the comments, this does not prevent a malicious user from changing the id to a different value using browser developer tools. Can you guess what will happen in this case? They will change the password for a different user, which is probably NOT what you want. Avoiding this huge security flaw is outside of the scope for this answer. However, one technique that can be used is to make use of cookies that hold a session ID token.

On your server side, you could have a list of active sessions in your database (or temporary file storage). This session database should have as its primary key a session_id that is securely generated (PHP has a function to do this). That database also holds information about the currently logged in user, including their ID. Then set a cookie parameter with the session_id. The user won't be able to modify it (although this might still be susceptible to things like sniffing and session hijacking - to protect against that look up information about MAC tokens).

With such a setup, you can simply remove the user ID as part of the form request and look it up based on the cookie information passed with the POST request. I recommend doing some reading about session cookies and MAC tokens if you want to make your application secure. If not, you will be hacked someday. One place to start is the PHP docs for session_id, and by reading other blogs and answers.