PHP - Php Commerce Help

Hey everyone. I am making a site for my brother's band and having some trouble with the checkout to paypal. Unfortunately in layout I missed a pretty important variable, the size on shirts. I am trying to add it in as a drop down option just before submitting to paypal but I can't get it to show up on paypal and thus will have no idea what size they are ordering. The site is pretty basic and primitive but I really need this info on the checkout. Here is a link to the temporary site where i'm trying to get this to work:
http://www.theblack44s.com/t/index3.php
and this is what is up and running now:
http://www.theblack44s.com/Merchant%20pages/apparel/index3.php
this is the code i'm working on in cart.php:
Code: [Select]
<?php
require "dbconcart.php";
session_start();

//session_destroy();


$page = 'index.php';


$value2 = $_POST['size'];

//add to cart function
if (isset($_GET['add'])) {
                                        $quantity = mysql_query('SELECT id, quantity, imageurl FROM apparel WHERE id='.mysql_real_escape_string((int)$_GET['add']));
                                        while ($quantity_row = mysql_fetch_assoc($quantity)) {
                                                if ($quantity_row['quantity']!=$_SESSION['cart_'.(int)$_GET['add']]) {
                                                        $_SESSION['cart_'.(int)$_GET['add']]+='1';
}
}
                                          header('Location: '.$page);        
                                        }

//remove from cart
if (isset($_GET['remove'])) {
        $_SESSION['cart_'.(int)$_GET['remove']]--;
        header('Location: '.$page);
}

//delete from cart
if (isset($_GET['delete'])) {
        $_SESSION['cart_'.(int)$_GET['delete']]='0';
        header('Location: '.$page);
                 
}

                  
// products
function products() {
        $get = mysql_query('SELECT id, name, item_number, description, price, shipping FROM apparel WHERE quantity > 0 ORDER BY id DESC');
        if (mysql_num_rows($get)==0) {
                        echo "There are no products to display!";
        }
        else {
                while ($get_row = mysql_fetch_assoc($get)) {
                        echo $get_row['name'].'<br />';
echo $get_row['item_number'].'<br />';
echo $get_row['description'].'<br />';
echo 'Price: '.number_format($get_row['price'], 2).'<br />';
echo 'Shipping: '.number_format($get_row['shipping'], 2);
echo '<a href="cart.php?add='.$get_row['id'].'">Add to cart</a></p>';                                        
                }
        }
        
}


//paypal function
function paypal_items() {
        $num = 0;
        foreach($_SESSION as $name => $value) {
                if ($value!=0) {
                        if (substr($name, 0, 5)=='cart_') {
                                $id = substr($name, 5, strlen($name)-5);
                                $get = mysql_query('SELECT id, name, item_number, price, shipping FROM apparel WHERE id='.mysql_real_escape_string((int)$id));
                                while ($get_row = mysql_fetch_assoc($get)) {
                                        $num++;
                                        echo '<input type="hidden" name="item_number_'.$num.'" value="'.$get_row['item_number'].'">';
                                        echo '<input type="hidden" name="item_name_'.$num.'" value="'.$get_row['name'].'">';
                                        echo '<input type="hidden" name="size_" value="$_POST'.$value2.']">';

echo '<input type="hidden" name="amount_'.$num.'" value="'.$get_row['price'].'">';
                                        echo '<input type="hidden" name="shipping_'.$num.'" value="'.$get_row['shipping'].'">';
                                        echo '<input type="hidden" name="shipping2_'.$num.'" value="'.$get_row['shipping'].'">';
                                        echo '<input type="hidden" name="quantity_'.$num.'" value="'.$value.'">';


                                }
                        }
            
                           }
                           
       }
}



//cart function
function cart() {
        foreach($_SESSION as $name => $value) {
                if ($value>0) {
                  if (substr($name, 0, 5)=='cart_') {
                          $id = substr($name, 5, (strlen($name)-5)); 
                        $get = mysql_query('SELECT id, name, price, imageurl FROM apparel WHERE id='.mysql_real_escape_string((int)$id));
                        while ($get_row = mysql_fetch_assoc($get)) {
                                $sub = $get_row['price']*$value;
                                echo $get_row['name'].' x '.$value.' @ $'.number_format($get_row['price'], 2).' = $'.number_format($sub, 2).'<br />';
?>
<html>
<body>

<form action="size.php"  method="post" name="size">
  <label>Size
  <select name="size">
    <option selected="selected">Select</option>
    <option value="youth">Youth (for the brats)</option>
    <option value="small">Small (petite)</option>
    <option value="medium">Medium (average)</option>
    <option value="large">Large (healthy)</option>
    <option value="xlarge">X Large (large)</option>
    <option value="xxlarge">XX Large (full figured</option>
    <option value="xxxlarge">XXX Large (huge)</option>
    <option value="xxxxlarge">XXXXLarge (DAMN!!)</option>
  </select>
  <input type="hidden" name="size" value="selected" />
  <input type="hidden" name="size" value="submit()" />
  </label>
</form>

</body>
</html>


<?php


echo '<a href="cart.php?remove='.$id.'">[-]</a> <a href="cart.php?add='.$id.'">[+]</a> <a href="cart.php?delete='.$id.'">[delete]</a><br />';             
                                
                                }
                        }
                        $total += $sub;        
                }        
        }
        
        //cart totals and paypal function
        if ($total==0) {
                echo "Your cart is empty.";
        }
        else {
                
                                echo '<p><b>Total: $ '.number_format($total, 2).'</b></p>';
                                ?>
                                <p>
                <form action="https://www.paypal.com/cgi-bin/webscr" target="_blank" method="post">
                <input type="hidden" name="cmd" value="_cart">
                <input type="hidden" name="upload" value="1">
                <input type="hidden" name="business" value="webmaster@theblack44s.com">
                <?php paypal_items(); ?>
                <input type="hidden" name="currency_code" value="USD">
                <input type="hidden" name="amount" value="<?php echo $total; ?>">
<input type="hidden" name="size" value="<?php echo $value2; ?>">
                <input type="image" src="http://www.paypal.com/en_US/i/btn/x-click-but03.gif" target="_blank" name="submit" alt="Make payments with PayPal - it's fast, free and secure!">
                </form>
                </p>
               <?php
        }
}

?>

Hi,

I got problems on my website http://www.tranceprofile.com/
When I want to go to my Storeadmin page (http://www.tranceprofile.com/storeadmin/) I get this:

Warning: session_start() [function.session-start]: open(/public/tmp/sess_64fb1b28e78195d89731106458023ab4, O_RDWR) failed: No such file or directory (2) in /public/sites/www.tranceprofile.com/storeadmin/index.php on line 5

Warning: session_start() [function.session-start]: Cannot send session cookie - headers already sent by (output started at /public/sites/www.tranceprofile.com/storeadmin/index.php:5) in /public/sites/www.tranceprofile.com/storeadmin/index.php on line 5

Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /public/sites/www.tranceprofile.com/storeadmin/index.php:5) in /public/sites/www.tranceprofile.com/storeadmin/index.php on line 5

Warning: Cannot modify header information - headers already sent by (output started at /public/sites/www.tranceprofile.com/storeadmin/index.php:5) in /public/sites/www.tranceprofile.com/storeadmin/index.php on line 7

Warning: Unknown: open(/public/tmp/sess_64fb1b28e78195d89731106458023ab4, O_RDWR) failed: No such file or directory (2) in Unknown on line 0

Warning: Unknown: Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/public/tmp) in Unknown on line 0

Can someone help me?
Here is my code Code: [Select]
<?php 
session_start();
if (!isset($_SESSION["manager"])) {
    header("location: admin_login.php"); 
    exit();
}
// Be sure to check that this manager SESSION value is in fact in the database
$managerID = preg_replace('#[^0-9]#i', '', $_SESSION["id"]); // filter everything but numbers and letters
$manager = preg_replace('#[^A-Za-z0-9]#i', '', $_SESSION["manager"]); // filter everything but numbers and letters
$password = preg_replace('#[^A-Za-z0-9]#i', '', $_SESSION["password"]); // filter everything but numbers and letters
// Run mySQL query to be sure that this person is an admin and that their password session var equals the database information
// Connect to the MySQL database  
include "../storescripts/connect_to_mysql.php"; 
$sql = mysql_query("SELECT * FROM admin WHERE id='$managerID' AND username='$manager' AND password='$password' LIMIT 1"); // query the person
// ------- MAKE SURE PERSON EXISTS IN DATABASE ---------
$existCount = mysql_num_rows($sql); // count the row nums
if ($existCount == 0) { // evaluate the count
 echo "Your login session data is not on record in the database.";
     exit();
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Store Admin Area</title>
<link rel="stylesheet" href="../style/style.css" type="text/css" media="screen" />
</head>

<body>
<div align="center" id="mainWrapper">
  <?php include_once("../template_header.php");?>
  <div id="pageContent"><br />
    <div align="left" style="margin-left:24px;">
      <h2>Hello store manager, what would you like to do today?</h2>
      <p><a href="inventory_list.php">Manage Inventory</a><br />
      <a href="#">Manage Blah Blah </a></p>
    </div>
    <br />
  <br />
  <br />
  </div>
  <?php include_once("../template_footer.php");?>
</div>
</body>
</html>

I am relatively new to php but I have been learning since the end of 2011.

At the moment, I am currently developing an E-Commerce website for a customer, using the Larry Ullman book "Effortless E-Commerce' as a guide.

I am hitting many brick walls at the moment though.

But before I state my long winded problem, I have attached all my work done thus far to this message.

HERES THE PROBLEM...

I have created a series of includes such as config.inc.php, form_functions.inc.php, login.inc.php and login_form.inc.php.

They are included/required with most of my other files.

However I have some major issues;

1. This is the code for my logout.php file;
Code: [Select]
<?php

require ('./includes/config.inc.php');

// If the user isn't logged in, redirect them:
redirect_invalid_user();

// Destroy the session:
$_SESSION = array(); // Destroy the variables.
session_destroy(); // Destroy the session itself.
setcookie (session_name(), '', time()-300); // Destroy the cookie.

// Include the header file:
$page_title = 'Logout';
include ('includes/header.html');

// Print a customized message:
include ('includes/main.html');
echo '<h3>Logged Out</h3><p>Thank you for visiting. You are now logged out. Please come back 

soon!</p>';

// Footer file needs the database connection:
require (MYSQL);

// Include the HTML footer:
include ('includes/footer.html');
?>
At the moment, I cannot determine if a user is logged in/when they logout, I cannot determine if there is an active session and also, when I log into the site, I have a database with values yet it seems to let any Tom, Dick and Harry onto the site to log in even though they are not stored in the database.

I apologise if this sounds confusing but I really need some major league help.

Help would be greatly appreciated

Hey guys I had created a while ago a script for my friend where you can buy points and then redeem stuff with those points, i'm looking for ways to keep my site secu currently what i have done-

- protected all mysql queries with mysql_real_escape_string, strip_tags, and addslashes
- have a valid SSL certificate on my website
- checked if emails are valid for account creation

what else can I do? Thank you.

I have an array that needs to display all titles and allow for a user to view titles based on the category, title, etc . I tried using the print_r() function but it didn't display the titles in a clean list. The only tutorials I've found utilize sql and i need to complete this without using SQL.
Code: [Select]
$books = array();
array_push($books,array("category" => "Nonfiction","title" => "The Innocent Man","author" => "Grisham","publisher" => "McGraw-Hill","price" => "34.99","isbn"
=> "5985420166"));
array_push($books,array("category" => "Business","title" => "How to Make Money","author" => "Richy","publisher" => "Prentice-Hall","price" => "49.99","isbn"
=> "8754739342"));
array_push($books,array("category" => "Romance","title" => "Twice Kissed","author" => "Jackson","publisher" => "McGraw-Hill","price" => "14.99","isbn"
=> "5671230987"));