Update database table row with submission data and set new values to NULL if empty

You should rely on prepared statements.

Only build the column names using a whitelist as dynamic SQL. Filter out empty strings ''. Insert anonymous prepared statement parameters ? and generate a type specifiers string. Then pass the values as bound parameters.

This one should work (could not test it yet).

<?php
declare (strict_types=1);

$km_user_id = 2;

// this array comes from the form
$form_array =
[
  'km_user_first_name'      => 'Antonio',
  'km_user_last_name'       => 'Acri',
  'km_user_address'         => 'via pola',
  'km_user_city'            => 'roma',
  'km_user_city_prov'       => '',
  'km_user_postcode'        => '',
  'km_user_email'           => '',
  'km_user_website'         => 'url',
  'km_user_telephone'       => '123456',
  'km_user_mobile'          => '',
  'km_user_fiscalcode'      => '',
  'km_user_document'        => '',
  'km_user_document_number' => '',
  'km_user_document_exp'    => '',
  'km_user_birth_place'     => '',
  'km_user_birth_date'      => '',
];

$white_list =
[
  'DEBUGkm_user_first_name'      => true, // DEBUG TEST filter
  'km_user_last_name'       => true,
  'km_user_address'         => true,
  'km_user_city'            => true,
  'km_user_city_prov'       => true,
  'km_user_postcode'        => true,
  'km_user_email'           => true,
  'km_user_website'         => true,
  'km_user_telephone'       => true,
  'km_user_mobile'          => true,
  'km_user_fiscalcode'      => true,
  'km_user_document'        => true,
  'km_user_document_number' => true,
  'km_user_document_exp'    => true,
  'km_user_birth_place'     => true,
  'km_user_birth_date'      => true,
];


// filter by whitelist and remove  ''  but NOT  '0'
$non_empty = array_intersect_key(array_filter($form_array, function($v){return $v !== '';}), $white_list);

if(!empty($non_empty))
{
  $cols   = '`' . implode('` = ?, `', array_keys($non_empty)) . ' = ?';
  $query  = "UPDATE `users` SET $cols WHERE `user_id` = ?";
  $values = array_values($non_empty);
  array_push($values, $km_user_id);

  $stmt = mysqli_prepare($db_user_conn, $query);
  mysqli_stmt_bind_param($stmt, str_repeat('s', count($non_empty)).'i', ...$values);
  mysqli_stmt_execute($stmt);
  // TODO: error handling
}

km_user_first_name should not be updated since it is not in the whitelist. Remove the prefix DEBUG when tested.

I hope I realize your question (fill free to comment if not).

If you want to have the form array as the main values and only if its empty take the value from the second array you can use combination on array_filter and array_merge.

Consider the following example:

$form = array("km_user_first_name" => "Alice", "km_user_address" => "");
$row = array("km_user_first_name" => "Boby", "km_user_address" => "via pola");
$res = array_merge($row, array_filter($form));

This will output:

Array
(
    [km_user_first_name] => Alice
    [km_user_address] => via pola
)

I know I use the form array second as said in PHP documentation (thanks @Nick):

If the input arrays have the same string keys, then the later value for that key will overwrite the previous one

Hope that helps!

Why creating another array? You can realy edit the array you already have. for example : You get the indexed array from database Fill the form with the values so the user can see old informations . When user edits lets say his name myArray ['name'] = $_POST ['name']

Create a firm foundation for your script by defining an array of whitelisted/editable columns, you might also associate some santization functions for each column (but I won't go too far down the rabbit hole of validation and sanitization).

Iterate the whitelist, use $_POST values if they exist and build a prepared statement and an array of values for each placeholder.

Then simply execute your prepared statement.

Code: (PHPize Demo)

// use mb_trim() when PHP version allows
$editableUserColumns = [
    'km_user_first_name' => 'trim',
    'km_user_last_name' => 'trim',
    'km_user_address' => 'trim',
    'km_user_city' => 'trim',
    'km_user_city_prov' => 'trim',
    'km_user_postcode' => 'trim',
    'km_user_email' => 'trim',
    'km_user_website' => 'trim',
    'km_user_telephone' => 'trim',
    'km_user_mobile' => 'trim',
    'km_user_fiscalcode' => 'trim',
    'km_user_document' => 'trim',
    'km_user_document_number' => 'trim',
    'km_user_document_exp' => 'trim',
    'km_user_birth_place' => 'trim',
    'km_user_birth_date' => 'trim'
];

if (empty($_POST['km_user_id'])) {
    exit('Invalid/Missing data');
}

$sets = [];
$vals = [];
foreach ($editableUserColumns as $col => $func) {
    $sets[] = "$col = NULLIF(?, '')";
    $vals[] = $func($_POST[$col] ?? '');
}
$sql = sprintf(
    'UPDATE users SET %s WHERE km_user_id = ?',
    implode(', ', $sets)
);
$vals[] = $_POST['km_user_id'];
$mysqli->execute_query($sql, $vals);
echo 'Affected rows: ' . $mysqli->affected_rows;