<?php
ob_start();

require("../../include/z_db.php");

if($_POST['Uname'] == '')
{
header('location:login.php');
exit
}

//get the users profile
$result = mysql_query("SELECT * FROM staff_users WHERE Uname='{$_SESSION['Uname']}'") or die(mysql_error());

$row = mysql_fetch_array( $result );

if($_GET['action'] == 'update')
{
if($_POST['Email'] == '')
   {
      echo error("blank");
      exit;
   }
   else
   {

      //update
      $_Email = str_replace("<", "", $_POST['Email']);
     
      $result = mysql_query("UPDATE staff_users SET Email='" . $_Email . "' WHERE Uname='{$_SESSION['Uname']}'")
      or die(mysql_error());
   }
}
function error($error)
{
if($error == 'blank')
{
echo "<b>Please fill in all the fields</b>";
}
if($error == 'updated')
{
echo "<b>Updated successfully</b>";
}
}
?>

<form method=post action=profile.php?action=update>
<table>
<tr><td>Username:</td><td><b>" . $row['Uname'] . "</b></td></tr>
<tr><td>Email:</td><td><input type=text name=Email value=" . $row['Email'] . "></td></tr>
<tr><td><a href=changepass.php>Change password</a></td><td></td></tr>
<tr><td></td><td><input type=submit value=Update></td></tr>
</table></form>