How to cross check POST with database - php

Question

Hi guys I was wondering if they is a way to cross check select options getting posted to a different page with a database just to make sure that someone hasn't change anything using a inspect element or firebug or any developer tool.
database table product
my database looks something like this but they are over 400 data in it.
pid name size
1 grey 12 inch
2 blue 16 inch
database table category
pid category
1 vans
2 nike
database table itemised
pid price
1 30.00
2 50.00
item.php
in my item.php page I have a table. The size and category and SELECT OPTION then I have an input field for amount which uses jquery for validation.
in my cartpage.php
I Posting the pid, size and category then I am using all those to find the price(I AM NOT POSTING THE PRICE, I AM USING THE pid, size and category to find it.)
Now the problem is, if someone was to change the value for the size or category or both. They will still get posted but obviously the price wouldn't be find because the database can't find those value getting posted.
How I show my value category example *similar to how i show size too apart from I change the select statement*
<select id="Category" name="Category">
<?php
dbconnect();
$stmt = $conn->prepare("SELECT Name FROM Category WHERE pid=:id");
$stmt->bindParam('id',$id);
$stmt->execute();
$i = 0;
foreach ($stmt->fetchAll(PDO::FETCH_ASSOC) as $row ) {
if ($i == 0) {
echo '<option SELECTED value="'.$row['Name'].'">'.$row['Name'].'</option>
';
}
else {
echo '<option value="'.$row['Name'].'">'.$row['Name'].'</option>';
}
$i++;
}
?>
</select>
My question
Is they a way to find out that what is getting posted exist in the database and it is related to the pid? and if not that item shouldn't be added.
Edited to add how my cart page looks like Jim Martens I have added the code you show in your answer
//I have session start on top of this page.
<?php
*jim matens your code starts here*
if (isset($_GET['pid'])){
$id = $_GET['ProdID'];
$categoryID = (isset($_POST['Category']) ? intval($_POST['Category']) : 0);
dbconnect();
$stmt1 = $conn->prepare("SELECT CatID FROM Category WHERE pid=:id");
$stmt1->bindParam('id',$id);
$stmt1->execute();
$isValid = false;
$rows2 = $stmt1->fetchAll(PDO::FETCH_ASSOC);
foreach ($rows2 as $row1) {
if ($row1['CatID'] == $categoryID) {
$isValid = true;
break;
}
}
}
*My code starts here*
if(isset($_POST['pid']) && isset($_POST['length']) && isset($_POST['Qty']) && isset($_POST['Category'])){
$pid = $_POST['pid'];
$length = $_POST["length"];
$qty = $_POST['Qty'];
$Category = $_POST['Category'];
$wasFound = false;
$i = 0;
// If the cart session variable is not set or cart array is empty
if (!isset($_SESSION["cart_array"]) || count($_SESSION["cart_array"]) < 1) {
// RUN IF THE CART IS EMPTY OR NOT SET
$_SESSION["cart_array"] = array(0 => array("item_id" => $pid, "length" => $length, "Category" => $Category, "quantity" => $qty));
} else {
// RUN IF THE CART HAS AT LEAST ONE ITEM IN IT
foreach ($_SESSION["cart_array"]as $array_key=>$each_item) {
if ($each_item['item_id'] == $pid && $each_item['length'] == $length && $each_item['Category'] == $Category) {
$_SESSION["cart_array"][$array_key]['quantity']+=$qty;
$wasFound = true;
} // close if condition
} // close while loop
// close foreach loop
if ($wasFound == false) {
array_push($_SESSION["cart_array"], array("item_id" => $pid, "length" => $length, "Category" => $Category, "quantity" => $qty));
}
}
header('Location: '.fetchinline($bpages).$currentFile);
exit();
}
?>
I hope I have explain this clearly and if not please leave a comment and I will try and rephrase the question.
Thanks

Answer 1

JavaScript validation is a nice gimmick for spelling issues and the like. But it is neither foolproof nor able to actually verify if the data is semantically correct. Therefore you need to send the data to the PHP script.
That script now verifies it first for integrity (correct value type and the like). After this initial step you verify against the database in your case. If I understand you correctly, you want to make sure that the sent category is an existing category. There is one very simple way to achieve that.
First your form.
<select id="Category" name="Category">
<?php
dbconnect();
// select the ID of the category as well (should be there anyway)
$stmt = $conn->prepare("SELECT ID, Name FROM Category WHERE pid=:id");
$stmt->bindParam('id',$id);
$stmt->execute();
$i = 0;
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
foreach ($rows as $row) {
if ($i == 0) { ?>
<option selected="selected" value="<?php echo $row['ID']; ?>"><?php echo $row['Name']; ?></option>
<?php } else { ?>
<option value="<?php echo $row['ID']; ?>"><?php echo $row['Name']; ?></option>
<?php
}
$i++;
}
?>
</select>
For the actual processing of the input, you read all categoryIDs from database and check if the selected ID (should be made to integer by now) is among them. If yes, everything's fine, if not the user has given invalid input.
A quick example for that:
$categoryID = (isset($_POST['Category']) ? intval($_POST['Category']) : 0);
dbconnect();
$stmt = $conn->prepare("SELECT ID FROM Category WHERE pid=:id");
$stmt->bindParam('id',$id);
$stmt->execute();
$isValid = false;
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
foreach ($rows as $row) {
if ($row['ID'] == $categoryID) {
$isValid = true;
break;
}
}
ID stands here for the category ID (whatever that is in your case).
Of course your real code would continue before and after this, but it should give you the general direction.