Best way to implement shopping cart using PHP/MySQL

Question

I'm working on a customer's website, and they've asked for a shopping cart. They need to use securetrading.net for the payment, so I don't need to ask for any credit card details. All I need to do is keep track of the items in their cart.

I've read about using PHP sessions, but I'm concerned about security there. Is this not a problem if the only information I'm storing is product codes and quantities? Otherwise, is it worth using a MySQL database?

I'm sorry if this seems like an obvious thing to know, but this is my first time implementing this kind of thing!

Answer 1

I'd use PHP sessions since you're only storing product codes/quantities. Yes these are open to "attack" -- but the attack would be something along the lines of changing product codes (make sure you add a check for valid codes before passing info to your payment gateway) and quantities (again do a check for quantity on hand if need be)

Session variables are open to attack by users but if someone wants to "trick" my system and checkout 4 items instead of 1 it's really not a problem at all.

Answer 2

I'd use a prefab open-source solution. You really don't want to let in silly security issues when you're dealing with other people's money.

Magento comes to mind. It's certainly the slickest I've seen in a while... And there appears to be securetrading support if you hack it in yourself.

Answer 3

Keep in mind that sessions will only last for, well, the session. If your customer walks away and comes back tomorrow to carry on shopping, they will find their basket is empty again.

If you are going to use sessions to get things going quickly, try and design your code so that it would be simple to change your mind in the future and switch to a Mysql solution.

However, unless you have very specific requirements, just find one of the hundreds of free solutions out there and save yourself a load of time.

Answer 4

There is tutorial for simple/small php/MySQL cart that keeps cart status in sessions, there is even downloadable demo code and online demo.

http://v3.thewatchmakerproject.com/journal/276/building-a-simple-php-shopping-cart

I used it when full blown online shoping programs were just that "over blown". Same as you there was no need to take cc data, user registration, etc... just siple place to send selected items to payment gateway's purchase proces and after that to forget about it. That is what client wanted, and that is what he got on the end (my first choice was magento but it was too complicated for clients 3 products).

Of course you need to extend it to fit your need but it's good starting point for something simple.