$sql = "UPDATE `user_data` SET `password`=$password, `username`=$username WHERE `id`=$id";
改成
$sql = "UPDATE `user_data` SET `password`='$password', `username`='$username' WHERE `id`='$id'";
即可
選我正解
文字的話要加上引號
$sql = "UPDATE `user_data` SET `password`='$password', `username`='$username' WHERE `id`=$id";
另外你這樣寫會有SQL Injection的問題,
那你的prepare就沒有意義了...