Question

Okay I have a basic task that I want to complete and I could do it if this site wasnt going be live but since it is I am going want it to be secure and my current method needs to be better

What I want is to change how many credits a user has so another words I have it where once they click the submit button it runs a php script and just simple pull that data under there account for Credits take that number (int) and subtract 1

But I am using this

$query = mysql_query("SELECT * FROM UsersList WHERE Credits='$CurrentCredits'");

and then I would simply

  $db = new PDO('mysql:dbname=;host=', aooza, 'Password');

     $insert = 'INSERT INTO `LIST` (`Credits`) VALUES (:NewCreditCount)';

    $statement = $db->prepare($insert);
    $statement->bindParam(':Credit', $_SESSION['Credit'], PDO::PARAM_STR);
    $statement->execute();

But of course this wont work because my main issue is that it is just enters the new credit count on a new row so there is no user and well I dont know a better way to say that

How do I make it where It changes it for that row rather then just abroad

Update code

$Credits = $_SESSION['Credits'];

 $update= 'UPDATE `PingPalooza` SET `Credits` = `Credits` - 1 WHERE `Email` = :Email LIMIT 1';

 $_SESSION['Credits']=$Credits;

 $statement = $db->prepare($update);
 $statement->bindParam(':Credits', $_SESSION['Credits'], PDO::PARAM_STR);
 $statement->bindParam(':Email', $_SESSION['Email']);
 $statement->execute();

Obviously this isn’t exactly what you gave me but I added the two variable things just to try and get it to work myself lol
lol always keep trying

Answer 1

Use an UPDATE query to modify an existing row:

$update= 'UPDATE `LIST` SET `Credits` = `Credits` - 1 WHERE `UserId` = :UserId LIMIT 1';

$statement = $db->prepare($update);

// you don'e need this line below if you are doing the subtraction in the query (like above)
//$statement->bindParam(':Credit', $_SESSION['Credit'], PDO::PARAM_STR);
$statement->bindParam(':UserId', $_SESSION['UserId']);
$statement->execute();

Assuming your target UserId is in $_SESSION['UserId'] and your field in the table is UserId.