insert data in form element does not insert into my tables?

[sashavalentina]

What i want to do here is to inser all my products into the table called cart. I used POST method in form action to post the data to my tables. But i am unsure why my data does not insert sucessfully into my cart tables. I make sure i named every variables properly but i do not know where did it goes wrong. can anyone please show me a helping hand? I really need help for this. Any form of help will be appreciated. Thanks!;

 

<div class="col-12">
            <div class="card">
             
              <div class="card-body">
              <form action="includes/add-item-to-cart-invoice.php" method="post">
<h4 class="card-title"> Step 2: Insert Selected Product Values</h4>
            <div class="table-responsive" style="max-height: 60vh">
        <div>
            <?php if(isset($message)) { echo $message; } ?></div>
            <!--<form method="post" action="">-->
              <table class="table">
                <thead class="text-primary">
                  <th style=" position: sticky;top: 0; background: white";>
                    Product
                  </th>
                  <th style=" position: sticky;top: 0; background: white";>
                    Name
                  </th> 
                  <th style=" position: sticky;top: 0; background: white";>
                    Avaliable Stock
                  </th> 
                  <th style=" position: sticky;top: 0; background: white";>
                    Item Price(RM)
                  </th>
                  <th style=" position: sticky;top: 0; background: white";>
                   Insert Product Quantity
                  </th>
                </thead>
                <tbody id="products">
                  <?php
                    $product_id = $_REQUEST['id'];
                    $ids = explode(",",$product_id);
                    $ids = array_splice($ids, 0);
                 
                    foreach($ids as $product_id){
                    $sql = "SELECT *, products.id as product_id FROM products 
                    LEFT JOIN sellers ON products.seller_id = sellers.id 
                    WHERE products.id = '".$product_id."' 
                    ORDER BY product_created DESC  ";
                    $query = $conn->query($sql);
                    {
                    while ($row = $query->fetch_assoc()) {
                        $max = $row['product_stock'];
                  ?>

                  <tr>
                   
                 
                    <td>
                      <?php echo $row['product_title']; ?>
                    </td>
                    <td>
                      <?php echo $row['product_stock']; ?> <?php echo $row['product_unit']; ?>
                    </td>
                    <td>
                    <div class="col-md-6">
                    <input type="number" name="cart_price" step=".01" class="form-control text-center" required>
                    </div>
                    </td>  
                    <td>
                    <div class="col-md-6">
                    <input type="number" name="cart_qty" step=".01" class="form-control text-center" required> 
                    </div>
                    </td>
                    </div>
                  <?php
                      }
                  }
                }
                  ?>
                </tbody>
              </table>
              
            </div>
          </div>
          <div class="card-body">
          <h4 class="card-title"> Step 3: Insert User ID</h4>
           <h6 class="card-title"><span class="text-danger">**Please make sure the User ID you enter exist**</span> </h6>
           <div class="form-group">
                    <label>SELECT SELLER *</label>
                    <select class="form-control" name="user_id" placeholder="search user..." required>
                    <!-- <option value="">Select a customer...</option> -->
                      <?php
                      $ssql = "SELECT * FROM users";
                      $squery = $conn->query($ssql);
                      while ($srow = $squery->fetch_assoc()) {
                      ?>
                      <option value="<?php echo $srow['id'];?>" ><?php echo $srow['user_fullname'];?></option>
                      <?php } ?>
                    </select>
                  </div>

            <div class="col-md-4">
          <!-- <input type="number" name="user_id" class="form-control text-center" required> -->
          <input type="hidden" name="cart_name" value="<?php echo $row['product_title']; ?>">
          <input type="hidden" name="cn_cart_name" value="<?php echo $row['product_title']; ?>">
          <input type="hidden" name="m_cart_name" value="<?php echo $row['product_title']; ?>">
          <input type="hidden" name="cart_image" value="<?php echo $row['product_photo']; ?>">
          <input type="hidden" name="cart_unit" value="<?php echo $row['product_unit']; ?>">
          <input type="hidden" name="product_id" value="<?php echo $row['id']; ?>">
          <input type="hidden" name="seller_id" value="<?php echo $row['seller_id']; ?>">
          </div>
            </div>
          </div>
                    
         <div class="d-flex p-4 justify-content-around">
                <div class="row">
            <button type="button" name="btn_delete" id="btn_previous" value="True" class="btn btn-danger btn-icon-split m-2" onclick="window.location='add-invoice.php'">
                        <span class="icon text-white-50">
                        </span>
          <i class="fa fa-arrow-left" aria-hidden="true"></i>
                        <span class="text">Back</span>
                    </button>
                <button type="submit" name="add_invoice_details" id="btn_next" value="True" class="btn btn-info btn-icon-split m-2">
                        <span class="icon text-white-50">
                        </span>
          <i class="fa fa-arrow-right" aria-hidden="true"></i>
                        <span class="text">Next</span>
                    </button>
                    </div>
            </div>
    </form>
   
          <!--</form>-->
        </div>
      </div>
    </div>
  </div>
</div>

This is my add-item-to-cart-invoice.php

 <?php
  include('../session.php');

  if(isset($_POST['add_invoice_details'])) {
    $cart_name = $_POST['cart_name'];
    $cn_cart_name = $_POST['cn_cart_name'];
    $m_cart_name = $_POST['m_cart_name'];
    $cart_image = $_POST['cart_image'];
    $cart_qty = $_POST['cart_qty'];
    $cart_unit = $_POST['cart_unit'];
    $cart_price = $_POST['cart_price'];
    $product_id = $_POST['product_id'];
    $seller_id = $_POST['seller_id'];
    $user_id = $_POST['user_id'];

    // $sql = "SELECT * FROM cart WHERE product_id = '$product_id' AND user_id = '$user_id' ";
    $query = $conn->query($sql);

    if (!mysqli_num_rows($query)) {
      $sql = "INSERT INTO `cart` (`cart_name`,`cn_cart_name`,`m_cart_name`, `cart_image`, `cart_qty`, `cart_unit`, `cart_price`, `product_id`, `user_id`, `seller_id`) VALUES ('$cart_name','$cn_cart_name','$m_cart_name', '$cart_image', '$cart_qty','$cart_unit', '$cart_price', '$product_id', '$user_id', '$seller_id')";
    } 
    else {
      $row = $query->fetch_assoc();
      $cart_qty = $_POST['cart_qty'] + $row['cart_qty'];

      $sql = "UPDATE cart SET `cart_qty` = '$cart_qty' WHERE product_id = '$product_id' AND user_id = '$user_id' ";
    }

    if($conn->query($sql)) {
      //$_SESSION['success'] = 'Product added to Cart';
    }
    else {
      //$_SESSION['error'] = $conn->error;
    }
    header('Location: cart.php');
  }
  ?>

 

Edited October 12, 2021 by sashavalentina

[requinix]

You are putting $_POST values directly into the query. The first step to fixing your problem is to stop doing that and to use prepared statements instead.

[Barand]

These fields shouldn't even be in the cart table, they should be retrieved from the product table when required. All you need are the ids and quantity (you certainly don't need the product title 3 times!).

Instead of a query to see if there is already a record for the user/product you should define that combination of columns as UNIQUE. Having done that you use a single query for the inserts and updates

INSERT INTO cart (user_id, product_id, seller_id, quantity)
VALUES (? , ? , ? , ?)
ON DUPLICATE KEY UPDATE
    quantity = VAUES(quantity);

 

Edited October 12, 2021 by Barand