Data types should be converted to judgments, such as id, and forced to be converted to plastic.

Values in mysql statements should be enclosed in single quotes.

$ username = add slashes($ _ GET[' username '])；

$ id = intval($ _ GET[' id '])；

$sql= "Update Member Set User Name ='$username' where id =' id' "；;

Ps: The submitted data will be automatically escaped under different configuration environments, so be careful not to escape repeatedly.