将购物篮中的商品添加到数据库

Question

我正在尝试将购物篮中的项目插入到我的数据库中的表userOrders中。 Mysql中的字段是productId，Quantity和orderTotal我知道我应该使用SSL。

我对此比较陌生，所以请善待我，非常感谢任何帮助。

购物篮：

<h1>View Shopping Basket</h1> 

<div class="container-fluid">
<div class="row">
    <div class="col-lg-6">
            <form method="post" value="placeOrder" action="<?php echo 
htmlspecialchars($_SERVER['PHP_SELF']); ?>" autocomplete="off">
            <form method="post" value="update" action="checkout.php?
page=cart"> 

<table class="table-responsive"> 
    <thead>
    <tr> 
        <th>productId</th> 
        <th>Name</th> 
        <th>Quantity</th> 
        <th>Price</th> 
        <th>Total</th> 
    </tr> 
</thead>
    <?php 
        //select all from products where ID is in session
        $sql="SELECT * FROM products WHERE productId IN ("; 
                //for each session append ID and add comma's to seperate  
                foreach($_SESSION['cart'] as $id => $val) { 
                    $sql.=$id.","; 
                } 
                //subtract last comma from ID's & append last bracket to 
prevent error  
                $sql=substr($sql, 0, -1).") ORDER BY name ASC"; 
                $query=mysql_query($sql); 
                $totalprice=00.00;
                $quantity =0;
                $productId = 'productId';
                while($row=mysql_fetch_array($query)){ 
                    //running total
                    $subtotal=$_SESSION['cart'][$row['productId']]
['quantity']*$row['price']; 
                    //total price added with each loop
                    $totalprice+=$subtotal; 
                ?> 
                    <tbody>
                    <tr> 
                        <!--hidden productId-->
                        <td><?php echo $row['productId'] ?></td>
                            <!--display product name-->
                        <td><?php echo $row['name'] ?></td> 
                            <!--display quantity-->
                            <!--take 'productID' & 'quantity' rows, -->

                        <td><input type="text" name="quantity[<?php echo 
$row['productId'] ?>]" size="2" value="<?php echo $_SESSION['cart']
[$row['productId']]['quantity'] ?>" /></td> 
                            <!--display price-->
                        <td><?php echo $row['price'] ?>£</td> 
                            <!--products price == quantity of productID in 
session * price -->
                        <td><?php echo $_SESSION['cart'][$row['productId']]
['quantity']*$row['price'] ?>£</td> 
                    </tr> 
                <?php 

                } 
            ?>
                <tr> 
                    <td colspan="4" style="text-align:right">Total Price: <?
php echo $totalprice ?></td> 
                </tr> 
            </tbody>
        </table> 
    </div>
</div>
</div>
<br /> 
<button type="submit" value="update" name="update">Update Shopping 
Basket</button> 
<br />
<button type="submit" value="PlaceOrder" name="PlaceOrder">Place 
Order</button>

</form>  
<br /> 
<p style="text-align:center">To remove an item set its quantity to 0. </p>
<a href="shopsesh.php?page=products"><p style="text-align:left">Continue 
Shopping</a></p>

更新数量：

<?php 
//check form was submitted, if yes & value ==0 then unset session.
if(isset($_POST['submit'])){ 

    foreach($_POST['quantity'] as $key => $val) { 
        if($val==0) { 
            unset($_SESSION['cart'][$key]); 
        //if form was submit and value =! 0 then update quantity
        }else{ 
            $_SESSION['cart'][$key]['quantity']=$val; 
        } 
    } 

} 
?>

插入查询：

<?php
//add items to orders table in DB
if (isset($_POST['placeOrder'])) {

    //if no error
    if( !$error ) {
        $productId = $_POST['productId'];
        $quantity = $_POST['quantity'];
        //$_POST['$totalPrice'];
        //insert order into database
        $query = "INSERT INTO userOrders(productId,quantity,orderTotal) 
VALUES('$productId','$quantity','$totalprice')";
        $res = mysql_query($query);

    if ($res) {
            $errTyp = "success";
            $errMSG = "Items added to database";

        } else {
            $errTyp = "danger";
            $errMSG = "Something went wrong, try again later...";   
        }   

    }
}
?>