Appending contents to an array [closed] - php

Question

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.
Closed 9 years ago.
I want to add data from my DB to an array when a user clicks a link e.g
echo 'ADD'.
i get the id of the element and query the database to get the details of the item clicked and display it using a for loop like this(on cart-page.php):
$cart = $_GET['cartid'];
$cartData = array();
$SQL = "SELECT * FROM tbl_product where id ='$cart'";
$result = mysql_query($SQL);
while($row = mysql_fetch_assoc($result)){
array_push($cartData, $row);
}
$length = count($cartData);
for($i = 0; $i < $length; $i++) {
echo '</tr>';
echo ' <td class="product">'.$cartData[$i]['name'].'</td>';
echo'<td class="quantity"><input type="text" value='.$cartData[$i]['quantity'].' class="inputform"/></td>';
echo '</tr>';
}
My problem is array_push() isn't appending the data. Each time i navigate away from cart-page.php and click a link the previous content in cartData[] is overwritten leaving only one row in cartData[] at a time. How i can i get the data appended to cartData[] whenever i click a link like the one shown above? Thanks

Answer 1

Does it need to be APpended? Why not just add it to the array and order the array at a later time?
PHP array sorting
while($row = mysql_fetch_assoc($result)){
$cartData[] = $row;
}
In addition, you should ALWAYS escape your data.
$cart = $_GET['cartid'];
The above code is vunerable to SQL injection. At the least, escape it!
$cart = mysql_real_escape_string($_GET['cartid']);
EDIT
In order to remember all previous cart additions, you will need to create a session, and add each click to it:
session_start();
$cartid = mysql_real_escape_string($_GET['cartid']);
function addToCart($cartid)
{
$SQL = "SELECT * FROM tbl_product where id ='{$cartid}'";
$result = mysql_query($SQL);
while($row = mysql_fetch_assoc($result)){
$_SESSION['cartItems'][] = $row;
}
}
function getCartItems()
{
print_r($_SESSION['cartItems']);
}
This will hopefully work as you expect. Sessions will retain state across browser refreshes.
To use this code, when you want to add items to the original $cartData, you need to call the function addToCart($cartid). This will add the item data to the cartItems session array
To see whats in the cart as an array, just use print_r($_SESSION['cartItems']);

Answer 2

Short answer: Your issue is not that you aren't adding the item to the array, it's that you don't understand how arrays work. Arrays do not persist across pages, they are instantiated to a single runtime of a single script unless declared otherwise.
MAJOR security flaw #1 - Sending cartid in URL:
Edit: I misunderstood this. Your cartid variable refers to a product_id. This is very poor variable naming, any programmer would assume this referred to an ID of a shopping cart. Whilst this security flaw is not relevant in this instance, I'm leaving it here for anyone who misunderstands your code and decides to copy it.
Firstly, this URL is a problem:
echo 'ADD'
This means that if I can guess another user's cart ID, I can add items to their shopping cart by visiting cart-page.php?action=add&cartid=100 where 100 is another user's cart ID. You should process the $cart variable internally using a validated session, not send them across the internet via GET or POST requests which can be user manipulated.
MAJOR security flaw #2 - Vulnerability to SQL Injection attacks:
The statement
$SQL = "SELECT * FROM tbl_product where id ='$cart'";
is incredibly dangerous. Let's say I submit this in my URL (properly encoded of course):
cartid = 2'; DROP TABLE tbl_product; SELECT * FROM tbl_product WHERE cartid='
This will then perform the following query on your database:
SELECT * FROM tbl_product where id ='2'; DROP TABLE tbl_product; SELECT * FROM tbl_product WHERE cartid='';
If you want to avoid this, you have a few options. The best of those options is to switch to using prepared statements, the easiest of those options is to use mysql_real_escape_string on everything you put into your database, like this:
$SQL = "SELECT * FROM tbl_product where id ='" . mysql_real_escape_string($cart) . "';";
Once you've fixed the above, we can fix the rest of the code:
First, we want to put your results into the array. As $results is already an associative array, you can either use it directly or store it like this:
$cartData = $results;
Keeping products in the cart
Edit: I misunderstood what you were doing, you're using a variable called $cart to store a product ID, you need to sort out your variable names.
In order to have an array which will persist across multiple page loads, you will need to make it a session variable, first you have to start a PHP session:
session_start();
Use a session variable like this:
$_SESSION['shopping_cart'] = array();
Then, when you 'add' a product, do this:
$_SESSION['shopping_cart'][$cartData['id']] = array(
'name'=>$cartData['name'],
'quantity'=>1
);
When you change the quantity, this:
$_SESSION['shopping_cart'][$productId]['quantity'] = $newQuantity;
Now, when you display the cart, instead of displaying directly from products, insert to the array using the above first, then return the contents of $_SESSION['shopping_cart'].
foreach was made for array transversal, use it!
Finally, don't use an ugly for loop to iterate an array, just do:
<?php foreach($_SESSION['shopping_cart'] as $product): ?>
<tr>
<td><?php echo $product['name'] ?></td>
<td><input type='text' value='<?php echo $product['quantity'] ?>'></input></td>
</tr>
<?php endforeach; ?>
Hope this helps, I haven't done all the work for you, but I have given you a lot of pointers in the right direction and identified some serious issues which matter.
Recommendations for this Project:
A shopping site is a major undertaking, you should spend some time reading about concepts like PHP security, sessions, relational databases etc. It may seem like an unnecessary hassle, but writing clean and secure code now means that when you have to debug it and make changes, you will be able to do so much more easily.
I'd also suggest you look into some (free, open source) MVC frameworks like Zend and CakePHP. These wont do all the work for you, but they will make it easier for you to keep your code well maintained and readable.