Shopping cart/basket session not going to database: PHP MySQL

Question

I am writing a program with php/mysql in which logged in users use a points system to order items through a shopping cart (no money,paypal,credit card payments,shipping taxes etc. are involved - points only) . My php knowledge is basic to low intermediate.

I have two scripts below:

1. The shopping cart/basket called view_cart.php This works fine (and disables checkout if they don't have enough points).

2. Order submission to database called submit_order.php

I am having trouble with linking the shopping cart session to the submit order page/database. I get the first error message but it creates a new order under the orders table but only with the logged in users ID number, while the total comes to 0. Nothing happens with the order_contents table either.

I am guessing it is something to do with the 'cart' session variables/array so if someone could help or steer me in the right direction that would be great.

Thanks A

view_cart.php below:

    <?php //view_cart.php
    $page_title = 'ViewCart';
    include ('./includes/header.html');

    if (!isset($_SESSION['users_id'])) {

       $url = 'http://' . $_SERVER['HTTP_HOST']
        . dirname($_SERVER['PHP_SELF']);
       if ((substr($url, -1) == '/') OR (substr($url, -1) == '\\') ) {
            $url = substr ($url, 0, -1); 
       }

       $url .= '/login.php'; 

    ob_end_clean(); 
    header("Location: $url"); 
    exit(); 
    }

    $rwp = $_SESSION['points'];    

    $problem = FALSE; 


    if (isset($_POST['submitted']))
       { 

    foreach ($_POST['qty'] as $k => $v) {

    $pid = (int) $k;
    $qty = (int) $v;

    if ( $qty == 0 ) { 
    unset ($_SESSION['cart'][$pid]);
    } elseif ( $qty > 0 ) { 
    $_SESSION['cart'][$pid] ['quantity'] = $qty;
    }

    } 
    } 

    $empty = TRUE;
    if (isset ($_SESSION['cart'])) {
    foreach ($_SESSION['cart'] as $key =>$value) {
    if (isset($value)) {
    $empty = FALSE;
    break; 
    }
    } 
    } 

    if (!$empty) {

    require_once ('mysql_connect.php');


    $query = "SELECT users_id, points FROM user_points
                WHERE user_points.users_id = users.users_id";
    $result = mysql_query($query);  


    $query = "SELECT products_id, products_name FROM categories, products
       WHERE categories.categories_id = products.categories_id AND products.products_id 
       IN (";foreach ($_SESSION['cart'] as $pid =>$value) {
    $query .= $pid . ',';
    }
    $query = substr ($query, 0, -1) . ') ORDER BY categories.categories_name ASC';
    $result = mysql_query($query);


    echo '
    <table border="0" width="100%" cellspacing="1" cellpadding="5"
       align="center">
    <tr class="top">
    <td align="left" width="46%"><b>Product</b></td>
    <td align="right" width="18%"><b>Price</b></td>
    <td align="center" width="16%"><b>Qty</b></td>
    <td align="right" width="20%"><b>Sub Total</b></td>
    </tr>
    <form action="view_cart.php" method="post">
    ';

    $total = 0; 

    while ($row = mysql_fetch_array($result, MYSQL_ASSOC)) {

    $subtotal = $_SESSION['cart'][$row
       ['products_id']]['quantity'] *
       $_SESSION['cart'][$row ['products_id']]['price'];
    $total += $subtotal;

    echo " <tr>
    <td align=\"left\">{$row['products_name']}</td>
    <td align=\"right\">{$_SESSION['cart'][$row['products_id']] ['price']} pts</td>
    <td align=\"center\"><input type=\"text\" size=\"3\"
       name=\"qty[{$row['products_id']}]\"
       value=\"{$_SESSION['cart'][$row['products_id']]['quantity']}\" /></td>
    <td align=\"right\">" . number_format ($subtotal) . " pts</td>
    </tr>\n";
    } 

    mysql_close($dbc); 

    $str = '<tr class="even">
    <td colspan="3" align="right"><b> TOTAL:<b></td>
    <td align="right"><b>' . number_format ($total) . ' pts </b></td>
    </tr>
    </table>
    <br />
    <div align="center"><input type="submit" name="submit" value="Update" />
    <input type="hidden" name="submitted" value="TRUE" />
    </form><br /><br /></div>';
    if($up >= $total) {
     $str .='<a href="submit_order.php">Submit Order</a></p>';
    }
    else {
     $str .='<p>You do not have enough points to proceed to checkout</p>'; 
    }   
    echo $str;

    } else {
    echo '<p>Your cart is currently empty.</p>';
    }
    ?>

    <?php
    include ('./includes/footer.html');
    ?>

Here is the submit_order.php script.

    <?php 
    $page_title = 'Order Confirmation';
    include ('./includes/header.html');

    if (!isset($_SESSION['users_id'])) {

       $url = 'http://' . $_SERVER['HTTP_HOST']
        . dirname($_SERVER['PHP_SELF']);
       if ((substr($url, -1) == '/') OR (substr($url, -1) == '\\') ) {
            $url = substr ($url, 0, -1); 
       }
       $url .= '/login.php'; 

    ob_end_clean(); 
    header("Location: $url"); 
    exit(); 
    }

    $users = $_SESSION['users_id']; // Temporary.

    $total = 0;

    require_once ('mysql_connect.php'); // Connect to the database.

    @mysqli_autocommit ($dbc, FALSE);

    $query = "INSERT INTO orders (users_id, total) VALUES 
        ($users, $total)";  
    $result = @mysql_query($query);
    if (@mysql_affected_rows($dbc) == 1) {

    $oid = @mysql_insert_id();

    $query = "INSERT INTO order_contents (order_id, products_id, quantity, price)
       VALUES ";
    foreach ($_SESSION['cart'] as $pid => $value) {
    $query .= "($oid, $pid, {$value['quantity']}, {$value['price']})";
    }
    $query = substr($query, 0, -2); 
    $result = @mysql_query($query);

    if (@mysql_affected_rows($dbc) == count($_SESSION['cart'])) { 

    @mysqli_commit($dbc);
    @mysql_close($dbc);

    unset($_SESSION['cart']);

    echo '<p>Thank you for your order.
       It has been submitted for processing.</p>';

    } else { 

    @mysqli_rollback($dbc);
    @mysql_close($dbc);

    echo '<p>Your order could not be processed due to a system error.
       You will be contacted in order to have the problem fixed.
       We apologize for the inconvenience 1.</p>';
    }
    }

    else { 

    @mysqli_rollback($dbc);
    @mysql_close($dbc);

    echo '<p>Your order could not be processed due to a system error.
       You will be contacted in order to have the problem fixed.
       We apologize for the inconvenience 2.</p>';
    }

    ?>
    </div></div>


    <?php  
    include ('./includes/footer.html');
    ?>

Answer 1

I guess you put session_start() in the wrong place. It must be called before the <html> tag.

Answer 2

I can't see

session_start(); 

Anywhere in here, are you calling it from a parent including file?