พี่ครับ ช่วยอธิบายการทำให้user แก้ไข ข้อมูลส่วนตัว หลัง จาก login แล้วหน่อยครับ

<a href=xxxx/xxxx.php?$user_edit=<?php echo $user_id ?>>แก้ไขข้อมูล</a>


xxx.php

$user_id=$_GET['user_id'];
$SQL="select*from account where user_id=$user_id ";
$rs=$db->Execute($SQL) or die(ERROR);
while(!$rs->EOF){
  $result=$rs->fields;
    $user=$result[username];
    $pass=$result[password];
$rs->MoveNext();

}

<a href=xxxx/xxxx.php?$user_edit=<?php echo $user_id ?>>แก้ไขข้อมูล</a>


xxx.php

$user_id=$_GET['user_id'];
$SQL="select*from account where user_id=$user_id ";
$rs=$db->Execute($SQL) or die(ERROR);
while(!$rs->EOF){
  $result=$rs->fields;
    $user=$result[username];
    $pass=$result[password];
$rs->MoveNext();

}

Imports System.Data.SqlClient
Imports System.Web.Security

Partial Class Login_Login
    Inherits System.Web.UI.Page

    Protected Sub btnLogin_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles btnLogin.Click

        If IsUser() Then
            Response.Redirect("../userprofile.aspx")
        Else
            MessageBox("Invalid Username & Password", "LoginFail")
            If member() Then
                Response.Redirect("../userprofile.aspx")
            Else
                MessageBox("Invalid Username & Password", "LoginFail")
            End If
        End If
    End Sub
    'Admin
    Protected Function IsUser() As Boolean
        Dim HaveUser As Boolean = False
        Dim user As Integer = 0
        Dim connectionString As String = "Data Source=DELL_BLUE-PC;Initial Catalog=Research;Integrated Security=SSPI;"
        Dim objConnection As New SqlConnection(connectionString)

        Dim commandString As String = "Select Count(*) From [admid] Where [Username]=@Username And [Password]=@Password"
        Dim objCommand As New SqlCommand(commandString, objConnection)
        objCommand.Parameters.AddWithValue("@Username", txtUsername.Text)
        objCommand.Parameters.AddWithValue("@Password", txtPassword.Text)

        Try
            objConnection.Open()
            user = CInt(objCommand.ExecuteScalar())
            objCommand.Clone()

            If user > 0 Then
                HaveUser = True
                Session("userid") = txtUsername.Text
                Session.Timeout = 20
            End If
        Catch ex As Exception
            MessageBox(String.Format("Error: {0}", ex.Message), "ErrorMessage")
            Exit Try
        End Try

        Return HaveUser
    End Function
    'member
    Protected Function member() As Boolean
        Dim HaveUser As Boolean = False
        Dim user As Integer = 0
        Dim connectionString As String = "Data Source=DELL_BLUE-PC;Initial Catalog=Research;Integrated Security=SSPI;"
        Dim objConnection As New SqlConnection(connectionString)

        Dim commandString As String = "Select Count(*) From [Mem_Normal] Where [Username]=@Username And [Password]=@Password"
        Dim objCommand As New SqlCommand(commandString, objConnection)
        objCommand.Parameters.AddWithValue("@Username", txtUsername.Text)
        objCommand.Parameters.AddWithValue("@Password", txtPassword.Text)

        Try
            objConnection.Open()
            user = CInt(objCommand.ExecuteScalar())
            objCommand.Clone()

            If user > 0 Then
                HaveUser = True
                Session("userid") = txtUsername.Text
                Session.Timeout = 20
            End If
        Catch ex As Exception
            MessageBox(String.Format("Error: {0}", ex.Message), "ErrorMessage")
            Exit Try
        End Try

        Return HaveUser
    End Function

    Protected Sub MessageBox(ByVal Message As String, ByVal MessageName As String)
        Dim ClientScript As ClientScriptManager = Page.ClientScript

        If Not ClientScript.IsClientScriptBlockRegistered(Me.GetType(), MessageName) Then
            ClientScript.RegisterClientScriptBlock(Me.GetType(), MessageName, String.Format("alert('{0}')", Message), True)
        End If
    End Sub
End Class

<%@ Page Title="Login" Language="VB" MasterPageFile="~/MasterPage/MasterPage.master" AutoEventWireup="false" CodeFile="Login.aspx.vb" Inherits="Login_Login" %>


<asp:Content ID="Content1" ContentPlaceHolderID="ContentPlaceHolder1" Runat="Server">
<center>

    <div style="height: 185px">
        <div style="position: relative; margin: 12px 12px 12px 12px; width: 250px;">  
            <div style="background: URL(../img/BDlogin/greenTop.gif) repeat-x top; position: absolute; left: 0px; top: -12px; height: 12px; width: 100%;"></div>  
            <div style="background: URL(../img/BDlogin/greenTopLeft.gif) no-repeat left top; position: absolute; left: -12px; width: 12px; top: -12px; height: 12px;"></div>  
            <div style="background: URL(../img/BDlogin/greenTopRight.gif) no-repeat right top; position: absolute; right: -12px; width: 12px; top: -12px; height: 12px;"></div>  
            <div style="background: URL(../img/BDlogin/greenLeft.gif) repeat-y left; position: absolute; left: -12px; width: 12px; top: 0px; bottom: 0px; height: 100%; _height: expression(eval(this.parentNode.clientHeight) + 'px');"></div>  
            <div style="background: URL(../img/BDlogin/greenRight.gif) repeat-y right; position: absolute; right: -12px; width: 12px; top: 0px; bottom: 0px; height: 100%; _height: expression(eval(this.parentNode.clientHeight) + 'px');"></div>  
            <div style="background: URL(../img/BDlogin/greenBottom.gif) repeat-x bottom; position: absolute; left: 0px; bottom: -12px; height: 12px; width: 100%;"></div>  
            <div style="background: URL(../img/BDlogin/greenBottomLeft.gif) no-repeat left bottom; position: absolute; left: -12px; width: 12px; bottom: -12px; height: 12px;"></div>  
            <div style="background: URL(../img/BDlogin/greenBottomRight.gif) no-repeat right bottom; position: absolute; right: -12px; width: 12px; bottom: -12px; height: 12px;"></div>  
            <div style="padding: 4px;">
                <div>
                    <span style="position: static; float: left;">
                        <asp:Label ID="lblUsername" runat="server" Text="UserName : " Height="21px"></asp:Label>                
                    </span>
                    <span style="position: static; float: right;">
                       <asp:TextBox ID="txtUsername" runat="server" Height="21px" Width="128px"></asp:TextBox>                
                        <asp:RequiredFieldValidator ID="RequiredFieldValidator1" runat="server" ErrorMessage="*" ControlToValidate="txtUsername"></asp:RequiredFieldValidator>
                    </span><br>                
                </div>
                <div style="clear: both; height: 5px;"></div>
                <div>
                    <span style="position: static; float: left;">
                        <asp:Label ID="lblPassword" runat="server" Text="Password : " Height="21px"></asp:Label>                
                    </span>
                    <span style="position: static; float: right;">
                        <asp:TextBox ID="txtPassword" runat="server" TextMode="Password" 
                        Height="21px" Width="128px"></asp:TextBox>                
                    <asp:RequiredFieldValidator ID="RequiredFieldValidator2" runat="server" ErrorMessage="*" ControlToValidate="txtPassword"></asp:RequiredFieldValidator>
                    </span>  
                </div>
                <div style="clear: both; height: 10px;"></div>
                <div style="text-align: right;">
                    <asp:Button ID="btnLogin" runat="server" Text="Login" />
                </div>
            </div>  
        </div> 
    </div>
  

</center>
</asp:Content>

If (Session("userid") = "") Then
            Me.lbl1.Text = "กรุณาเข้าระบบ"
            Response.AppendHeader("Refresh", "5; URL=../login/login.aspx")

<%@ Master Language="VB" CodeFile="MasterPage.master.vb" Inherits="MasterPage" %>
<%@ Register TagPrefix="UserControls" TagName="LoginControl" Src="~/LoginUserControl.ascx" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
    <title></title>
    <asp:ContentPlaceHolder id="head" runat="server">
    </asp:ContentPlaceHolder>
</head>
<body class="thrColFixHdr">
    <form id="form1" runat="server">
    <div>
        <div style="border: 1px solid black; padding: 10px;">
            <h1>Header</h1>
        </div>
        <div>
            <div style=" border-right: 1px solid black; border-left: 1px solid black; width: 200px; float: left; padding: 10px;">
                Menu
            </div>
            <div style="width: 400px; float: left; padding: 10px;">
                <asp:ContentPlaceHolder id="ContentPlaceHolder1" runat="server">
                </asp:ContentPlaceHolder>                    
            </div>
            <div style="width: 200px; float:right; border-right: 1px solid black; border-left: 1px solid black; padding: 10px;">
               <UserControls:LoginControl ID="LoginControl" runat="server"></UserControls:LoginControl>
            </div>
        </div>
        <div style="clear: both; border: 1px solid black; padding: 10px;">
            Footer
        </div>
    </div>
    </form>
</body>
</html>

<%@ Page Title="" Language="VB" MasterPageFile="~/MasterPage.master" AutoEventWireup="false" CodeFile="Login.aspx.vb" Inherits="Login" %>

<asp:Content ID="Content1" ContentPlaceHolderID="head" Runat="Server">
</asp:Content>
<asp:Content ID="Content2" ContentPlaceHolderID="ContentPlaceHolder1" Runat="Server">
    <asp:Label ID="Label1" runat="server" Text="Please Login."></asp:Label>
</asp:Content>

<%@ Control Language="VB" AutoEventWireup="false" CodeFile="LoginUserControl.ascx.vb" Inherits="LoginUserControl" %>

Imports System.Data
Imports System.Data.SqlClient

Partial Class LoginUserControl
    Inherits System.Web.UI.UserControl

    Private userTextBox As TextBox
    Private passwordTextBox As TextBox

    Protected Sub Page_Init(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Init
        userTextBox = New TextBox()
        passwordTextBox = New TextBox()
    End Sub

    Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
        If Session("UserID") Is Nothing Then
            CreateLoginForm()
        Else
            UserProfile()
        End If
    End Sub

    Protected Sub loginButton_Click(ByVal sender As Object, ByVal e As System.EventArgs)
        Dim strConnection As String = "Data Source=.\SQLEXPRESS;Initial Catalog=SqlDatabase;Integrated Security=True"
        Dim Connection As New SqlConnection(strConnection)

        Dim strCommand As String = "Select [UserID] From [UserTable] Where [UserName]=@UserName And [UserPassword]=@UserPassword"
        Dim Command As New SqlCommand(strCommand, Connection)
        Command.Parameters.AddWithValue("@UserName", userTextBox.Text)
        Command.Parameters.AddWithValue("@UserPassword", passwordTextBox.Text)

        Dim UserID As Integer = 0

        Try
            Connection.Open()
            Dim dataReader As SqlDataReader = Command.ExecuteReader(CommandBehavior.SingleRow)
            dataReader.Read()
            UserID = CInt(dataReader("UserID"))
            dataReader.Close()
            Connection.Close()
        Catch ex As Exception
            MessageBox.Show(String.Format("Error: {0}", ex.Message))
        End Try

        If UserID > 0 Then
            Session("UserID") = UserID

            Response.Redirect("~/LoginSuccess.aspx")
        Else
            Session("UserID") = Nothing

            MessageBox.Show("User Name หรือ Password ไม่ถูกต้อง")
        End If
    End Sub

    Protected Sub logoutButton_Click(ByVal sender As Object, ByVal e As System.EventArgs)
        Session("UserID") = Nothing

        Response.Redirect("~/Login.aspx")
    End Sub

    Protected Sub CreateLoginForm()
        Dim userLabel As New Label()
        userLabel.Text = "User:"
        Me.Controls.Add(userLabel)

        Me.Controls.Add(userTextBox)

        Me.Controls.Add(New LiteralControl("<br />"))

        Dim passwordLabel As New Label()
        passwordLabel.Text = "Password:"
        Me.Controls.Add(passwordLabel)

        passwordTextBox.Width = 120
        passwordTextBox.TextMode = TextBoxMode.Password
        Me.Controls.Add(passwordTextBox)

        Me.Controls.Add(New LiteralControl("<br />"))

        Dim loginButton As New Button()
        loginButton.Text = "Login"
        AddHandler loginButton.Click, New EventHandler(AddressOf loginButton_Click)
        Me.Controls.Add(loginButton)
    End Sub

    Protected Sub UserProfile()
        Dim strConnection As String = "Data Source=.\SQLEXPRESS;Initial Catalog=SqlDatabase;Integrated Security=True"
        Dim Connection As New SqlConnection(strConnection)

        Dim strCommand As String = "Select [UserName], [UserPassword] From [UserTable] Where [UserID]=@UserID"
        Dim Command As New SqlCommand(strCommand, Connection)
        Command.Parameters.AddWithValue("@UserID", CInt(Session("UserID")))

        Dim UserName As String = String.Empty

        Try
            Connection.Open()
            Dim dataReader As SqlDataReader = Command.ExecuteReader(CommandBehavior.SingleRow)
            dataReader.Read()
            UserName = dataReader("UserName").ToString()
            dataReader.Close()
            Connection.Close()
        Catch ex As Exception
            MessageBox.Show(String.Format("Error: {0}", ex.Message))
        End Try

        Dim userLabel As New Label()
        userLabel.Text = String.Format("Welcome {0}", UserName)
        Me.Controls.Add(userLabel)

        Me.Controls.Add(New LiteralControl("<br />"))

        Dim editProfile As New HyperLink()
        editProfile.Text = "Edit Profile"
        editProfile.NavigateUrl = "~/EditProfile.aspx"
        Me.Controls.Add(editProfile)

        Me.Controls.Add(New LiteralControl("<br />"))

        Dim logoutButton As New Button()
        logoutButton.Text = "Loout"
        AddHandler logoutButton.Click, New EventHandler(AddressOf logoutButton_Click)
        Me.Controls.Add(logoutButton)
    End Sub
End Class

<%@ Page Title="" Language="VB" MasterPageFile="~/MasterPage.master" AutoEventWireup="false" CodeFile="LoginSuccess.aspx.vb" Inherits="LoginSuccess" %>

<asp:Content ID="Content1" ContentPlaceHolderID="head" Runat="Server">
</asp:Content>
<asp:Content ID="Content2" ContentPlaceHolderID="ContentPlaceHolder1" Runat="Server">
    <asp:Label ID="Label1" runat="server" Text="Success"></asp:Label>
</asp:Content>

Partial Class LoginSuccess
    Inherits System.Web.UI.Page
 
    Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
        If Session("UserID") Is Nothing Then
            Response.Redirect("~/Login.aspx")
        End If
    End Sub
End Class

<%@ Page Title="" Language="VB" MasterPageFile="~/MasterPage.master" AutoEventWireup="false" CodeFile="EditProfile.aspx.vb" Inherits="EditProfile" %>

<asp:Content ID="Content1" ContentPlaceHolderID="head" Runat="Server">
</asp:Content>
<asp:Content ID="Content2" ContentPlaceHolderID="ContentPlaceHolder1" Runat="Server">
    <asp:Label ID="Label1" runat="server" Text="User:"></asp:Label>
    <asp:TextBox ID="userTextBox" runat="server"></asp:TextBox>
    <br />
    <asp:Label ID="Label2" runat="server" Text="Password:"></asp:Label>
    <asp:TextBox ID="passwordTextBox" TextMode="Password" runat="server"></asp:TextBox>
    <br />
    <asp:Label ID="Label3" runat="server" Text="Confirm:"></asp:Label>
    <asp:TextBox ID="confirmTextBox" TextMode="Password" runat="server"></asp:TextBox>
    <asp:CompareValidator ID="CompareValidator1" runat="server" ErrorMessage="CompareValidator" ControlToValidate="passwordTextBox" ControlToCompare="confirmTextBox"></asp:CompareValidator>
    <br />
    <asp:Button ID="saveButton" runat="server" Text="Save" />
    <asp:Button ID="cancelButton" runat="server" Text="Cancel" />
</asp:Content>

Imports System.Data
Imports System.Data.SqlClient

Partial Class EditProfile
    Inherits System.Web.UI.Page

    Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
        If Session("UserID") Is Nothing Then
            Response.Redirect("~/Login.aspx")
        End If
    End Sub

    Protected Sub saveButton_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles saveButton.Click
        Dim strConnection As String = "Data Source=.\SQLEXPRESS;Initial Catalog=SqlDatabase;Integrated Security=True"
        Dim Connection As New SqlConnection(strConnection)

        Dim strCommand As String = "Update [UserTable] Set [UserName]=@UserName, [UserPassword]=@UserPassword Where [UserID]=@UserID"
        Dim Command As New SqlCommand(strCommand, Connection)
        Command.Parameters.AddWithValue("@UserName", userTextBox.Text)
        Command.Parameters.AddWithValue("@UserPassword", passwordTextBox.Text)
        Command.Parameters.AddWithValue("@UserID", CInt(Session("UserID")))

        Try
            Connection.Open()
            Command.ExecuteNonQuery()
            Connection.Close()
        Catch ex As Exception
            MessageBox.Show(String.Format("Error: {0}", ex.Message))
        End Try

        MessageBox.Show("อัฟเดตข้อมูลเรียบร้อย")

        Session("UserID") = Nothing
        Response.Redirect("~/Login.aspx")
    End Sub

    Protected Sub cancelButton_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles cancelButton.Click
        Response.Redirect("~/LoginSuccess.aspx")
    End Sub
End Class

Imports System.Data
Imports System.Configuration
Imports System.Web
Imports System.Web.Security
Imports System.Web.UI
Imports System.Web.UI.WebControls
Imports System.Web.UI.WebControls.WebParts
Imports System.Web.UI.HtmlControls

Imports System.Collections
Imports System.Text

''' <summary>
''' Summary description for MessageBox
''' </summary>
Public Class MessageBox
	Private Shared m_executingPages As New Hashtable()

			'
			' TODO: Add constructor logic here
			'
	Public Sub New()
	End Sub

	Public Shared Sub Show(sMessage As String)
		' If this is the first time a page has called this method then
		If Not m_executingPages.Contains(HttpContext.Current.Handler) Then
			' Attempt to cast HttpHandler as a Page.
			Dim executingPage As Page = TryCast(HttpContext.Current.Handler, Page)

			If executingPage IsNot Nothing Then
				' Create a Queue to hold one or more messages.
				Dim messageQueue As New Queue()
				' Add our message to the Queue
				messageQueue.Enqueue(sMessage)
				' Add our message queue to the hash table. Use our page reference
				' (IHttpHandler) as the key.
				m_executingPages.Add(HttpContext.Current.Handler, messageQueue)
				' Wire up Unload event so that we can inject
				' some JavaScript for the alerts.
				AddHandler executingPage.Unload, New EventHandler(AddressOf ExecutingPage_Unload)
			End If
		Else
			' If were here then the method has allready been
			' called from the executing Page.
			' We have allready created a message queue and stored a
			' reference to it in our hastable.
			Dim queue As Queue = DirectCast(m_executingPages(HttpContext.Current.Handler), Queue)
			' Add our message to the Queue
			queue.Enqueue(sMessage)
		End If
	End Sub

	' Our page has finished rendering so lets output the
	' JavaScript to produce the alert's
	Private Shared Sub ExecutingPage_Unload(sender As Object, e As EventArgs)
		' Get our message queue from the hashtable
		Dim queue As Queue = DirectCast(m_executingPages(HttpContext.Current.Handler), Queue)

		If queue IsNot Nothing Then
			Dim sb As New StringBuilder()
			' How many messages have been registered?
			Dim iMsgCount As Integer = queue.Count
			' Use StringBuilder to build up our client slide JavaScript.
			sb.Append("<script language='javascript'>")
			' Loop round registered messages
			Dim sMsg As String

			While System.Math.Max(System.Threading.Interlocked.Decrement(iMsgCount),iMsgCount + 1) > 0
				sMsg = DirectCast(queue.Dequeue(), String)
				sMsg = sMsg.Replace(vbLf, "\n")
				sMsg = sMsg.Replace("""", "'")
				sb.Append("alert( """ & sMsg & """ );")
			End While
			' Close our JS
			sb.Append("</script>")
			' Were done, so remove our page reference from the hashtable
			m_executingPages.Remove(HttpContext.Current.Handler)
			' Write the JavaScript to the end of the response stream.
			HttpContext.Current.Response.Write(sb.ToString())
		End If
	End Sub
End Class