shopping cart sometimes makes sales for $0...how to troubleshoot?

Question

I am not using a pre-made shopping cart, I programming it myself. It works perfectly fine 99% of the time, but about once every couple months an order goes through for $0. I cannot figure out why. I make a test purchase with the same product and all the same info and I cannot get it to be $0 for me. I am not sure how to go about trouble shooting this, I do have a disclaimer saying that we do not honor erroneous prices. The client wants this to stop happening though. I am using PHP to do all of this. Since I cannot seem to duplicate the occurnace myself I am finding it hard to get to the bottom of the issue. Can anyone offer some advice on how to troubleshoot this?

Thanks!!

Answer 1

Do you have a URL to the site?

Otherwise I can only guess that somewhere you are allowing data passed in by the user to determine the price (e.g. a hidden field or a parameter) which the user can override.

Make sure you are passing an ID for the product to your server side code, and multiply the price on the server * the order quantity. (e.g. never trust user input)

Answer 2

Ultimately, you'll want to figure out why this is happening. Without seeing your code, I can't really help you out much with that. In the short term though, why not just add a sanity check at the end of the checkout process?

if ( $final_price < 1 ) {
    do_epic_fail(); // Show an error, whatever.
}

Answer 3

Are you posting the amount details to the payment gateway from the client side (hidden form fields)? If so then it can easily overridden by using browser toolbars like web developer etc.

Always post the payment details from the server side.

Answer 4

I'd start by using some extensive order logging. Every click, every input, every sql query. Then when it happens again go through the logs of that order to see what happened.

There are a couple of possibilities that spring to mind. One, you have a transient error in the queries to pull the item totals. Maybe when the query fails you just default to 0.00. For example, what happens when they type -1 for the quantity or put in some text like 'ABC'

Alternatively you might have a sql injection issue where if the user puts something wrong in one of the fields it loads a zero value for price.

Whatever it is will come to light with the right logging.

Answer 5

Does your code rely on $_SESSION data? If a user was to wait a very long time, some necessary data might expire, but the checkout may still proceed.

As the others have said, it's difficult to comment further without source code.

Answer 6

If the final price is 0, perhaps check the order again to see if it actually contains any items. I could see possibly having an order for zero if you have any free items or special promotions going on, so perhaps this is the way to go.

This is a hard question to answer without seeing your source.