title: MySQL Edit form is overwriting all database entries
body: <p>I have 3 pages: search.html. search.php, and edit.php</p>
  
  <p>I also have new.php which I can use to create an entry into my MySQL database, and it works perfectly, I can view the data and it's where it's supposed to be. Then, I have search.html and search.php which I use to do a very basic search of the database, and it again works perfectly.</p>
  
  <p>Then, in the results (on search.php) I have an edit link that launches edit.php with the data beside the returned results, and it loads edit.php along with the correct data. So I think I'm ok up to this point. But then, when I edit my form and click submit, it overwrites every entry in the database, instead of just the entry that I initially tried to edit. Been messing with this for about an hour now and not sure where I've messed up. Code below:</p>
  
  <p><strong>Search.html</strong></p>
  
  <pre><code>&lt;html&gt;
  &lt;head&gt;
  &lt;title&gt;Search the Database&lt;/title&gt;
  &lt;/head&gt;
  
  &lt;body&gt;
  &lt;form action="search.php" method="post"&gt;
    Search:
    &lt;input type="text" name="term" /&gt;
    &lt;br /&gt;
    &lt;input type="submit" name="submit" value="Submit" /&gt;
  &lt;/form&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p><strong>Search.php</strong></p>
  
  <pre><code>&lt;?php
  mysql_connect ("myhost", "myuser","mypass")  or die (mysql_error());
  mysql_select_db ("mydb");
  
  $term = $_POST['term'];
  
  $sql = mysql_query("select * from mytable where fname like '%$term%'");
  
  while ($row = mysql_fetch_array($sql)){
      echo '&lt;br/&gt; First Name: '.$row['fname'];
      echo '&lt;br/&gt; Last Name: '.$row['lname'];
      echo '&lt;td&gt;&lt;a href="edit.php?id=' . $row['id'] . '"&gt;Edit&lt;/a&gt;&lt;/td&gt;';
      echo '&lt;br/&gt;&lt;br/&gt;';
      }
  
  ?&gt;
  </code></pre>
  
  <p><strong>Edit.php</strong></p>
  
  <pre><code>&lt;?php
  function renderForm($id, $fname, $lname)
   {
   ?&gt;
  &lt;!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"&gt;
  &lt;html&gt;
  &lt;head&gt;
  &lt;link rel="stylesheet" type="text/css" href="mystyle.css"&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;div id="stylized" class="myform"&gt;
  &lt;form id="form" name="form" action="" method="post"&gt;
    &lt;input type="hidden" name="id" value="&lt;?php echo $id; ?&gt;"/&gt;
    &lt;h1&gt;Edit Entry&lt;/h1&gt;
    &lt;Label&gt;First Name/Organization &lt;/label&gt;
    &lt;input type="text" name="fname" value="&lt;?php echo $fname; ?&gt;"/&gt;
    &lt;Label&gt;Attn. &lt;/label&gt;
    &lt;input type="text" name="attn" value="&lt;?php echo $attn; ?&gt;"/&gt;
    &lt;input type="submit" name="submit" value="Submit"&gt;
    &lt;/div&gt;
  &lt;/form&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  &lt;?php
   }
  
   include('settings.php');
  
   if (isset($_POST['submit']))
   { 
   if (is_numeric($_POST['id']))
   {
   $id = $_POST['id'];
   $fname = mysql_real_escape_string(htmlspecialchars($_POST['fname']));
   $lname = mysql_real_escape_string(htmlspecialchars($_POST['lname']));
  
   if ($fname == '' || $lname == '')
   {
  
   $error = 'ERROR: Please fill in all required fields!';
  
   renderForm($id, $fname, $lname);
   }
   else
   {
  
   mysql_query("UPDATE entries SET fname='$fname', lname='$lname'")
   or die(mysql_error()); 
  
   header("Location: index.html"); 
   }
   }
   else
   {
   echo 'Error!';
   }
   }
   else
   {
  
   if (isset($_GET['id']) &amp;&amp; is_numeric($_GET['id']) &amp;&amp; $_GET['id'] &gt; 0)
   {
   $id = $_GET['id'];
   $result = mysql_query("SELECT * FROM entries WHERE id=$id")
   or die(mysql_error()); 
   $row = mysql_fetch_array($result);
  
   if($row)
   {
  
   $fname = $row['fname'];
   $lname = $row['lname'];
  
   renderForm($id, $fname, $lname, '');
   }
   else
  
   {
   echo "No results!";
   }
   }
   else
  
   {
   echo 'Error!';
   }
   }
  ?&gt;
  </code></pre>