I am trying to create a form that updates user information stored in an Oracle database, the updates are not going through correctly and I can't see a problem as I have the form printing out the SQL being submitted to oracle and it all checks out.

Here is the php that forms the connection:

```
<?php
$sql="select * from Members where MemberID = ".$_GET["memberid"];
$conn = oci_connect("user","pass", "conn");
$stmt = oci_parse($conn, $sql);
oci_execute($stmt);
$row=oci_fetch_row($stmt);
oci_free_statement($stmt);
oci_close($conn);
?>

```

Here is the form with an example or two of the forms inputs:

```
    <div class="topwrapper"><img src="logo.png" alt="Peak Park Sailing Club"></div>
<form name="form1" method="post" action="editmemhandler.php">
 <input name="MemberID" type=hidden id="MemberID" value=<?php print $row[0];?>>
 <table class="infotable">
      <tr>
      <td><strong>Member ID</strong></td>
      <td><input name="memberid" type="text" id="memberid" value=<?php print $row[0];?>></td>
    </tr>
    <tr>
      <td><strong>First Name</strong></td>
      <td><input name="firstname" type="text" id="firstname" value=<?php print $row[1];?>></td>
    </tr>

```

And here is the handler php:

```
<?php
IF ($_POST[groupid]=="") $groupid=0;
ELSE $groupid=$_POST[groupid];

$memberid=$_POST["memberid"];
$firstname=$_POST["firstname"];
$lastname=$_POST["lastname"];
$dob=$_POST["dob"];
$membertype=$_POST["membertype"];
$houseno=$_POST["houseno"];
$street=$_POST["street"];
$town=$_POST["town"];
$county=$_POST["county"];
$postcode=$_POST["postcode"];
$lastjoined=$_POST["lastjoined"];

$sql = "UPDATE Members SET firstname='$firstname', lastname='$lastname', dob='$dob', membertype='$membertype', groupid=$groupid, houseno='$houseno', street='$street', town='$town', county='$county', postcode='$postcode' where memberid=$memberid;";

$conn = oci_connect("user","pass", "conn");
$stmt = oci_parse($conn, $sql);
oci_execute($stmt);
print "Record updated ok </br>";
print $sql;
oci_free_statement($stmt);
oci_close($conn);
?>

```

I am very new to php and using it with Oracle so it is likely to be something obvious...

Thanks in advance!

Bob P
['https://Stackoverflow.com/questions/23341774', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/3548774/']
Try this:

```
$conn = oci_connect("user","pass", "conn");

$sql = "UPDATE Members SET firstname=:firstname, lastname=:lastname, dob=:dob, membertype=:membertype, groupid=:groupid, houseno=:houseno, street=:street, town=:town, county=:county, postcode=:postcode where memberid=:memberid;";
$stmt = oci_parse($conn, $update);
oci_bind_by_name($stmt, ':firstname', $firstname);
oci_bind_by_name($stmt, ':lastname', $lastname);
oci_bind_by_name($stmt, ':dob', $dob);
oci_bind_by_name($stmt, ':membertype', $membertype);
oci_bind_by_name($stmt, ':groupid', $groupid);
oci_bind_by_name($stmt, ':houseno', $houseno);
oci_bind_by_name($stmt, ':street', $street);
oci_bind_by_name($stmt, ':county', $county);
oci_bind_by_name($stmt, ':postcode', $postcode);
oci_bind_by_name($stmt, ':memberid', $memberid);

$result = oci_execute($stmt, OCI_DEFAULT);
if (!$result) {
  echo oci_error();   
}

oci_commit($conn);

```

This way of working will reduce your sql injection a little aswell.. I wrote this just out of my head.. Havn't had the chance of testing this, because I don't have the oracle DB for it. But try it.
You haven't enclosed $memberid variable in qoutes in query

.... `where memberid='$memberid';"`