UPDATE SQL with prepared stmt using only 1 variable
As it stands right now, you are wide open to sql injection injection attacks because you are copying posted data directly into your sql update statement.  All kinds of nasty things could be injected.

I started to rewrite it but it became a pain since mysqli requires you to bind each parameter individually.  Way too much work.  I'd suggest shifting to PDO which supports binding by arrays as well as named parameters.  Not to mention exceptions.

Something like:

// Some test data
$_POST   = array('name' =&gt; 'New Name', 'email' =&gt; 'New Email', 'something' =&gt; 'nothing', 'userId' =&gt; 1);

$allowed = array("name","surname","email","rank"); 

$params = array();
$items = null;

foreach($_POST as $key =&gt; $value) {
    if (in_array($key , $allowed)) {
        if ($items) $items .= ', ';
        $items .= "$key=:$key";
        $params[$key] = $value;
    }
}
if (!$items) die("Nothing to update");
echo $items . "\n"; // name=:name, email=:email

$sql = sprintf('UPDATE %s SET %s WHERE ID = :userId','users',$items);

echo $sql . "\n"; // UPDATE users SET name=:name, email=:email WHERE ID = :userId

$params['userId'] = $_POST['userId'];

$stmt = $pdo-&gt;prepare($sql);
$stmt-&gt;execute($params); // This is reason enough to shift to PDO