如何通过邮寄和ajax安全提交价格？

Question

I'm making an extremely simple store in order to understand more about how payment can work (but it should really work. I will sell a few old books). The 'store' is just a simple html list of products. The cart adds and removes them via javascript. Payment is via a stripe elements integration. The simplest way to do this is just to send the total from the shopping cart to a stripe charge object. My question is: what is the best way to send the price in the cart to the stripe charge object? I'm worried specifically that people could manipulate the price before submitting, but I don't want to tie my super simple shop to a database if I can avoid it. Is my method secure enough for my purposes? What better methods exist? More details: I have a payment form that runs a php action via a jquery ajax submission. The ajax function gets the total from the html element $('#total') via jquery . In the php document, I get the total from the $_POST array and charge it. Is this ok? Is it otherwise stupid? Or ok for a really small shop?

My demo is working, I'm just interesting in learning more about best practices. I googled 'send price from cart securely via ajax to php ' but didn't see anything that answered this question.

<div id="total">72.00</div>

var total = parseFloat($('#total').text())*100;
        $.ajax({
        method: 'POST',
        url: 'charge.php',
        data: { stripeToken: token.id, stripeEmail: token.email, totalAmount: totalForm},
        success: function(response) {
            console.log(response);
        },
      })

$token = $_POST['stripeToken'];
$total = $_POST['totalAmount'];
try{
    $charge = \Stripe\Charge::create([
        'amount' => $total,
        'currency' => 'chf',
        'description' => 'Example charge',
        'source' => $token,
    ]);
    $charge_send = $charge->__toJSON();
    $success_msg = 'Thank you for your purchase.';
    echo json_encode(array('success' => $success, 'charge' => $charge, 'err' => $err));
}

It's working fine. I just want it to be as secure as it should be for my purposes.

-> Thanks for the answers! I see folks think I should have a minimal database. @HTMHell : Is this because the price otherwise cannot be securely passed?

Answer 1

most of payment system included applications require to have user has been registered. It shows summary of payment complete page after user clicked on submit button and user checked everything on page. you can go payment action when user has checked. it is nice to check payment with user ID. user account has double checked with real payments methods are good.