Shopping cart save data to database php mysql

Question

I am currently working on saving a data to database using php mysql in shopping cart

cart.php

<?php
        foreach($_SESSION['cart'] as $product_id => $quantity) {    


            $sql = sprintf("SELECT prod_name, prod_code, prod_desc, prod_category, prod_price FROM product WHERE prod_id = %d;",
                            $product_id); 

            $result = mysql_query($sql);

            //Only display the row if there is a product (though there should always be as we have already checked)
            if(mysql_num_rows($result) > 0) {

                list($name, $code, $description, $category, $price) = mysql_fetch_row($result);

                $line_cost = $price * $quantity;        //work out the line cost
                $total = $total + $line_cost;           //add to the total cost

                echo "<tr>";

                    echo "<td align=\"center\">$name</td>";
                    echo "<td align=\"center\">$code</td>";
                    echo "<td align=\"center\">$description</td>";
                    echo "<td align=\"center\">$category</td>";
                    echo "<td align=\"center\">$quantity</td>";
                    echo "<td align=\"center\"><a href=\"index.php?page=inso94&action=add&id=$product_id\" class=\"btn btn-info btn-sm btn-fill pull-right\">Add quantity</a></td>";
                    echo "<td align=\"center\"><a href=\"index.php?page=inso94&action=remove&id=$product_id\" class=\"btn btn-warning btn-sm btn-fill pull-right\">Reduce</a></td>";
                    echo "<td align=\"center\">$price</td>";
                    echo "<td align=\"center\">$line_cost</td>";

                echo "</tr>";

            }

        }


        echo "<tr>";
            echo "<td colspan=\"0\" align=\"left\"> <a href=\"index.php?page=inso94&action=empty\" class=\"btn btn-danger btn-sm btn-fill pull-right\">Empty Cart</a></td>";
            echo "<td colspan=\"7\" align=\"right\">Total</td>";
            echo "<td align=\"right\"><b>$total</b></td>";
        echo "</tr>";
        echo "<tr>";
            echo "<td align=\"left\" colspan=\"9\">Note: If quantity becomes <b>'0'</b> it will automatically remove.</td>";
        echo "</tr>";
    echo "</table>";
    ?>
        *<?php
            if (isset($_POST['submit'])){
               $orderid=mysql_insert_id();

                $max=count($_SESSION['cart']);
                for($i=0;$i<$max;$i++){
                    $pid=$_SESSION['cart'][$i]['productid'];
                    $q=$_SESSION['cart'][$i]['quantity'];
                    $total;
                    mysql_query("insert into order_detail values ($orderid,$pid,$q,$total)");
            }
        }
        ?>
        <form action="<?php $_SERVER['PHP_SELF']; ?>" method="POST">    
            <button type="submit" name="submit" class="btn btn-info btn-sm btn-fill pull-right" id="checkout">Buy Now</button>
        </form>*

I want to save the data in to my database using a form .please help me, this is my last problem that i want to solve.

Answer 1

you should use some MVC Framework like yii2 for your application to get a clearer separation of concerns here. At the moment you mix up UI and business code which is not very maintainable. Also this framework provides you ActiveRecords which makes it easy to store formulars into db.

But here is a solution in pure PHP:

Lets assume you have a formular with has the fields amount, note, price for example.

Formular

<form action="storeOrder.php" method="post">
<div class="form-group">
    <label>Amount:</label>
    <input type="text" name="amount">
</div>
<div class="form-group">
    <label>Notes:</label>
    <input type="text" name="notes">
</div>
<div class="form-group">
    <label>Price:</label>
    <input type="text" name="price">
</div>

storeOrder.php

$host = "localhost";
$username = "root";
$password = "";
$database = "my_db";
$dsn = "mysql:host=$host;dbname=$database";

try {

    //establish connection to db
    $conn = new PDO( $dsn, $username, $password );
    $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

    //get inputs from form
    if (isset($_POST['submit'])) {
        $amount = $_POST['amount'];
        $note = $_POST['note'];
        $price = $_POST['price'];
    }

    //insert data into db and escape the form data to a void sql injection attacks
    $sql = "INSERT INTO orders(amount, note, price) VALUES (".
        $conn->quote($name). ",",
        $conn->quote($note). ",",
        $conn->quote($price). ",",
    . ")";

    $result = conn->query($sql);
} catch (PDOException $e) {
    exit("Connection failed: " . $e->getMessage());
}

Answer 2

试试这个查询

insert into order_detail values ('{$orderid}','{$pid}','{$q}','{$total}')