0

I have trouble when creating code for adding an item to shopping cart. What I did is echo each individual item customers could buy, and I wanted to add an input type for how many of that specific item they want, then "add to cart" button and repeat (echo another item, another input and button etc.)

while ($zaznam = mysqli_fetch_assoc($vysledek)) {
$soubor=$zaznam["img_nazev"];
echo "<div id='zbozi_info'>";
echo "<img src='img/$soubor'>";
echo "<p class='popis'>".$zaznam["dlouhy_popis"]."</p>";
echo "<p class='cena'> Cena bez DPH: ";
echo "<span style=color:#FF0000>".$zaznam["cena"]." Kč </span> </p>";
echo "<p class='cena'> Cena s DPH: ";
echo "<span style=color:#FF0000>".$zaznam["CenaDPH"]." Kč </span> </p>";
echo "</div>";
echo "<form method='post'>
<label for='pocetk'>Počet kusů</label> 
<br>
<input type='text' name='pocetk' id='pocetk' value='1'>
<br>
<input type='submit' name='pridkos' id='pridkos' value='Přidat do košíku'>
</form>";
}

This works and all, the trouble starts when I add this if to the mix, to enable that adding function

if (isset($_POST["pridkos"]) && isset($_SESSION['user'])) {

$ksk="INSERT INTO kosik 
             (ID_uzivatele,ID_zbozi, pocet_kusu) 
      VALUES ('".$_SESSION['user']."',
              '".$zaznam["ID_zbozi"]."',
              '".$_POST["pocetk"]."');";


  $vysledek = mysqli_query($con,$ksk)  
         or die("Zboží nebylo přidáno do košíku");

This just dies on the mysqli_query. I am not exactly sure if to put it inside the while or outside, my suspicion is inside, but it isn't working either way Session[user] has the user ID (ID_uzivatele), not sure what else can I clarify. Any help is appreciated.

Ma4zu6
  • 1
  • [Your code is vulnerable to SQL injection attack.](http://stackoverflow.com/q/332365/1935077) – Petr R. Feb 03 '16 at 18:43
  • Yeah that is possible, thank you for this but that's not really my concern right now. I will not be using this commercialy in any way, it's for local host usage only. Still, thank you. – Ma4zu6 Feb 03 '16 at 19:28

1 Answers1

0

    I think this query syntax is wrong.

    Check with below one:-

    $ksk="INSERT INTO kosik(ID_uzivatele,ID_zbozi, pocet_kusu) 
          VALUES ('$_SESSION[user]',
                  '$zaznam[ID_zbozi]',
                  '.$_POST["pocetk"]')";