PHP - E-commerce Website Help

Hey guys I had created a while ago a script for my friend where you can buy points and then redeem stuff with those points, i'm looking for ways to keep my site secu currently what i have done-

- protected all mysql queries with mysql_real_escape_string, strip_tags, and addslashes
- have a valid SSL certificate on my website
- checked if emails are valid for account creation

what else can I do? Thank you.

Hi all,

I'm a bit of a newbie to this type of website and would be extremely grateful for any help on this as it's causing considerable headaches! 

I've been working on an e-commerce (Online Shop) website based on the site found he http://www.phpwebcommerce.com/

I have been building it into a template from the original shop that was essentially a static website with links to paypal for the cart etc.

Now I am trying to add an extra function to the site but cant get my head around the logic to making this work and I know it can be done!

The shop is to sell mainly shoes with some accessories. So I understand that shoes obviously come in a variety of sizes, and each size needs to have its own product ID in the MySQL DB so I can show whether it is in stock etc.

What I cant figure out is how to firstly make an easy way of adding the shoes different sizes (for eg 10 shoes of the same type in sizes 40-49) to the DB in one hit instead of filling in the same form 10 times but with different sizes. I have the simple form already made and working successfully. My thoughts are to add check box in the form to say I'm adding multiple shoes that tells the process to look for values in text areas for starting shoe size and last shoe size. The process then takes the start size from the end size giving the number of times to loop the process. It then loops the process for each size using the same information... Logically this works but I'm not sure how to code this on what I have. I have attached the files used directly in this.

Secondly how do I group the shoes on the front end.

Now each product on the front end currently will display a simple message instead of add to cart when the stock = 0, or the product has been made as available on request.

I would like to group the shoes of the same type to have a drop down menu showing the available sizes. When a size is selected it needs to query the DB for available stock and either show the 'Add to cart' or 'Call to order' options.

Anything else you might need to help with this let me know. I'm keen to get this bit done so I can get the site live!

Thanks in advance

Hey everyone. I am making a site for my brother's band and having some trouble with the checkout to paypal. Unfortunately in layout I missed a pretty important variable, the size on shirts. I am trying to add it in as a drop down option just before submitting to paypal but I can't get it to show up on paypal and thus will have no idea what size they are ordering. The site is pretty basic and primitive but I really need this info on the checkout. Here is a link to the temporary site where i'm trying to get this to work:
http://www.theblack44s.com/t/index3.php
and this is what is up and running now:
http://www.theblack44s.com/Merchant%20pages/apparel/index3.php
this is the code i'm working on in cart.php:
Code: [Select]
<?php
require "dbconcart.php";
session_start();

//session_destroy();


$page = 'index.php';


$value2 = $_POST['size'];

//add to cart function
if (isset($_GET['add'])) {
                                        $quantity = mysql_query('SELECT id, quantity, imageurl FROM apparel WHERE id='.mysql_real_escape_string((int)$_GET['add']));
                                        while ($quantity_row = mysql_fetch_assoc($quantity)) {
                                                if ($quantity_row['quantity']!=$_SESSION['cart_'.(int)$_GET['add']]) {
                                                        $_SESSION['cart_'.(int)$_GET['add']]+='1';
}
}
                                          header('Location: '.$page);        
                                        }

//remove from cart
if (isset($_GET['remove'])) {
        $_SESSION['cart_'.(int)$_GET['remove']]--;
        header('Location: '.$page);
}

//delete from cart
if (isset($_GET['delete'])) {
        $_SESSION['cart_'.(int)$_GET['delete']]='0';
        header('Location: '.$page);
                 
}

                  
// products
function products() {
        $get = mysql_query('SELECT id, name, item_number, description, price, shipping FROM apparel WHERE quantity > 0 ORDER BY id DESC');
        if (mysql_num_rows($get)==0) {
                        echo "There are no products to display!";
        }
        else {
                while ($get_row = mysql_fetch_assoc($get)) {
                        echo $get_row['name'].'<br />';
echo $get_row['item_number'].'<br />';
echo $get_row['description'].'<br />';
echo 'Price: '.number_format($get_row['price'], 2).'<br />';
echo 'Shipping: '.number_format($get_row['shipping'], 2);
echo '<a href="cart.php?add='.$get_row['id'].'">Add to cart</a></p>';                                        
                }
        }
        
}


//paypal function
function paypal_items() {
        $num = 0;
        foreach($_SESSION as $name => $value) {
                if ($value!=0) {
                        if (substr($name, 0, 5)=='cart_') {
                                $id = substr($name, 5, strlen($name)-5);
                                $get = mysql_query('SELECT id, name, item_number, price, shipping FROM apparel WHERE id='.mysql_real_escape_string((int)$id));
                                while ($get_row = mysql_fetch_assoc($get)) {
                                        $num++;
                                        echo '<input type="hidden" name="item_number_'.$num.'" value="'.$get_row['item_number'].'">';
                                        echo '<input type="hidden" name="item_name_'.$num.'" value="'.$get_row['name'].'">';
                                        echo '<input type="hidden" name="size_" value="$_POST'.$value2.']">';

echo '<input type="hidden" name="amount_'.$num.'" value="'.$get_row['price'].'">';
                                        echo '<input type="hidden" name="shipping_'.$num.'" value="'.$get_row['shipping'].'">';
                                        echo '<input type="hidden" name="shipping2_'.$num.'" value="'.$get_row['shipping'].'">';
                                        echo '<input type="hidden" name="quantity_'.$num.'" value="'.$value.'">';


                                }
                        }
            
                           }
                           
       }
}



//cart function
function cart() {
        foreach($_SESSION as $name => $value) {
                if ($value>0) {
                  if (substr($name, 0, 5)=='cart_') {
                          $id = substr($name, 5, (strlen($name)-5)); 
                        $get = mysql_query('SELECT id, name, price, imageurl FROM apparel WHERE id='.mysql_real_escape_string((int)$id));
                        while ($get_row = mysql_fetch_assoc($get)) {
                                $sub = $get_row['price']*$value;
                                echo $get_row['name'].' x '.$value.' @ $'.number_format($get_row['price'], 2).' = $'.number_format($sub, 2).'<br />';
?>
<html>
<body>

<form action="size.php"  method="post" name="size">
  <label>Size
  <select name="size">
    <option selected="selected">Select</option>
    <option value="youth">Youth (for the brats)</option>
    <option value="small">Small (petite)</option>
    <option value="medium">Medium (average)</option>
    <option value="large">Large (healthy)</option>
    <option value="xlarge">X Large (large)</option>
    <option value="xxlarge">XX Large (full figured</option>
    <option value="xxxlarge">XXX Large (huge)</option>
    <option value="xxxxlarge">XXXXLarge (DAMN!!)</option>
  </select>
  <input type="hidden" name="size" value="selected" />
  <input type="hidden" name="size" value="submit()" />
  </label>
</form>

</body>
</html>


<?php


echo '<a href="cart.php?remove='.$id.'">[-]</a> <a href="cart.php?add='.$id.'">[+]</a> <a href="cart.php?delete='.$id.'">[delete]</a><br />';             
                                
                                }
                        }
                        $total += $sub;        
                }        
        }
        
        //cart totals and paypal function
        if ($total==0) {
                echo "Your cart is empty.";
        }
        else {
                
                                echo '<p><b>Total: $ '.number_format($total, 2).'</b></p>';
                                ?>
                                <p>
                <form action="https://www.paypal.com/cgi-bin/webscr" target="_blank" method="post">
                <input type="hidden" name="cmd" value="_cart">
                <input type="hidden" name="upload" value="1">
                <input type="hidden" name="business" value="webmaster@theblack44s.com">
                <?php paypal_items(); ?>
                <input type="hidden" name="currency_code" value="USD">
                <input type="hidden" name="amount" value="<?php echo $total; ?>">
<input type="hidden" name="size" value="<?php echo $value2; ?>">
                <input type="image" src="http://www.paypal.com/en_US/i/btn/x-click-but03.gif" target="_blank" name="submit" alt="Make payments with PayPal - it's fast, free and secure!">
                </form>
                </p>
               <?php
        }
}

?>

I am relatively new to php but I have been learning since the end of 2011.

At the moment, I am currently developing an E-Commerce website for a customer, using the Larry Ullman book "Effortless E-Commerce' as a guide.

I am hitting many brick walls at the moment though.

But before I state my long winded problem, I have attached all my work done thus far to this message.

HERES THE PROBLEM...

I have created a series of includes such as config.inc.php, form_functions.inc.php, login.inc.php and login_form.inc.php.

They are included/required with most of my other files.

However I have some major issues;

1. This is the code for my logout.php file;
Code: [Select]
<?php

require ('./includes/config.inc.php');

// If the user isn't logged in, redirect them:
redirect_invalid_user();

// Destroy the session:
$_SESSION = array(); // Destroy the variables.
session_destroy(); // Destroy the session itself.
setcookie (session_name(), '', time()-300); // Destroy the cookie.

// Include the header file:
$page_title = 'Logout';
include ('includes/header.html');

// Print a customized message:
include ('includes/main.html');
echo '<h3>Logged Out</h3><p>Thank you for visiting. You are now logged out. Please come back 

soon!</p>';

// Footer file needs the database connection:
require (MYSQL);

// Include the HTML footer:
include ('includes/footer.html');
?>
At the moment, I cannot determine if a user is logged in/when they logout, I cannot determine if there is an active session and also, when I log into the site, I have a database with values yet it seems to let any Tom, Dick and Harry onto the site to log in even though they are not stored in the database.

I apologise if this sounds confusing but I really need some major league help.

Help would be greatly appreciated

I have an array that needs to display all titles and allow for a user to view titles based on the category, title, etc . I tried using the print_r() function but it didn't display the titles in a clean list. The only tutorials I've found utilize sql and i need to complete this without using SQL.
Code: [Select]
$books = array();
array_push($books,array("category" => "Nonfiction","title" => "The Innocent Man","author" => "Grisham","publisher" => "McGraw-Hill","price" => "34.99","isbn"
=> "5985420166"));
array_push($books,array("category" => "Business","title" => "How to Make Money","author" => "Richy","publisher" => "Prentice-Hall","price" => "49.99","isbn"
=> "8754739342"));
array_push($books,array("category" => "Romance","title" => "Twice Kissed","author" => "Jackson","publisher" => "McGraw-Hill","price" => "14.99","isbn"
=> "5671230987"));