PHP MYSQL如果结帐成功，则从数据库中清除购物车数据

Question

如果结帐成功，我正在尝试从数据库中清除/删除购物车数据。

这是我网站上的表格

这是继续检出按钮

的过程

<?php
function emptyCart(){
    // delete query
    $cID = $_SESSION['cID'];
    $query = "DELETE FROM cart WHERE customer_id = $cID";
    $stmt = $this->conn->prepare($query);
 
    if($stmt->execute()){
        return true;
    }
 
    return false;
}

if (isset($_POST['checkout-submit'])) {
    $cID = $_POST['customer_id'];
    require 'dbh.inc.php';

    $order_Fname = mysqli_real_escape_string($conn, $_POST['order_Fname']);
    $order_Lname = mysqli_real_escape_string($conn, $_POST['order_Lname']);
    $order_name = $order_Fname .' '. $order_Lname;

    $order_number = 'PSAU000';

    $order_phone = mysqli_real_escape_string($conn, $_POST['order_phone']);
    $order_email = mysqli_real_escape_string($conn, $_POST['order_email']);

    $order_Addrs = mysqli_real_escape_string($conn, $_POST['order_Addrs']);
    $order_Addrs2 = mysqli_real_escape_string($conn, $_POST['order_Addrs2']);
    $pro = mysqli_real_escape_string($conn, $_POST['pro']);
    $mun = mysqli_real_escape_string($conn, $_POST['mun']);
    $bar = mysqli_real_escape_string($conn, $_POST['bar']);
    $order_address = $order_Addrs .', '. $order_Addrs2 .', '. $pro .', '. $mun .', '. $bar;
    
    $sql = "INSERT INTO orders (order_number, order_name, order_phone, order_email, order_address, order_date)
    VALUES ('$order_number','$order_name','$order_phone','$order_email','$order_address', NOW())";

    if ($conn->query($sql) === TRUE) {
        $msg1 = "Item-Ordered-Succesfully.";
        header("Location: ../checkout.php?msg=$msg1");
        emptyCart();
        exit();
    } else {
        $msg2 = "Please-try-again.";
        header("Location: ../checkout.php?msg=$msg2");
        exit();
    }
    
}
else {
    header ("Location: ../index.php");
    exit();
}

此过程将在 ORDERS TABLE （订单表）上插入表格值，但购物车中仍然有商品。

Answer 1

因此，结帐成功后，我可以通过在$ sql中添加多个查询来删除CART列中的数据。

$sql = "INSERT INTO orders (order_number, order_name, order_phone, order_email, order_address, order_date)
VALUES ('$order_number','$order_name','$order_phone','$order_email','$order_address', NOW()); DELETE FROM cart WHERE customer_id = $cID";

并
从

更改此代码

if ($conn->query($sql) === TRUE) {

进入

if ($conn->multi_query($sql)) {

<?php

if (isset($_POST['checkout-submit'])) {
    $cID = $_POST['customer_id'];
    require 'dbh.inc.php';

    $order_Fname = mysqli_real_escape_string($conn, $_POST['order_Fname']);
    $order_Lname = mysqli_real_escape_string($conn, $_POST['order_Lname']);
    $order_name = $order_Fname .' '. $order_Lname;

    $order_number = 'PSAU000';

    $order_phone = mysqli_real_escape_string($conn, $_POST['order_phone']);
    $order_email = mysqli_real_escape_string($conn, $_POST['order_email']);

    $order_Addrs = mysqli_real_escape_string($conn, $_POST['order_Addrs']);
    $order_Addrs2 = mysqli_real_escape_string($conn, $_POST['order_Addrs2']);
    $pro = mysqli_real_escape_string($conn, $_POST['pro']);
    $mun = mysqli_real_escape_string($conn, $_POST['mun']);
    $bar = mysqli_real_escape_string($conn, $_POST['bar']);
    $order_address = $order_Addrs .', '. $order_Addrs2 .', '. $pro .', '. $mun .', '. $bar;
    
    
    $sql = "INSERT INTO orders (order_number, order_name, order_phone, order_email, order_address, order_date)
    VALUES ('$order_number','$order_name','$order_phone','$order_email','$order_address', NOW()); DELETE FROM cart WHERE customer_id = $cID";

    // $sql. = "DELETE FROM cart WHERE customer_id = $cID"; 

    if ($conn->multi_query($sql)) {
        $msg1 = "Item-Ordered-Succesfully.";
        header("Location: ../checkout.php?msg=$msg1");
        exit();
    } else {
        $msg2 = "Please-try-again.";
        header("Location: ../checkout.php?msg=$msg2");
        exit();
    }
    
}
else {
    header ("Location: ../index.php");
    exit();
}

感谢您的先前评论，我将尝试研究那些PDO和有关sql注入的信息。