如何在MYSQL表中存储购物车内容（foreach？）

问题描述：

我有一个工作车（请参阅下面的代码），但现在我想将'content'订单'MYSQL表中的内容存储在'dbexample'数据库中。添加了'order_number'和'order_status'字段。这将允许我做一个订单跟踪/状态系统。如何在MYSQL表中存储购物车内容（foreach？）

我的车看起来是这样的：（通过“立即购买”我要打开的地方，order.php这就是代码应该去看看。）

<?php 
session_start(); 
include_once("config.php"); 
?> 
<!DOCTYPE html> 
<html> 
<head> 
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> 
<title>View shopping cart</title> 
<link href="style/style.css" rel="stylesheet" type="text/css"></head> 
<body> 
<h1 align="center">View Cart</h1> 
<div class="cart-view-table-back"> 
<form method="post" action="cart_update.php"> 
<table width="100%" cellpadding="6" cellspacing="0"><thead><tr><th>Quantity</th><th>Name</th><th>Price</th><th>Total</th><th>Remove</th></tr></thead> 
    <tbody> 
    <?php 
    if(isset($_SESSION["cart_products"])) //check session var 
    { 
     $total = 0; //set initial total value 
     $b = 0; //var for zebra stripe table 
     foreach ($_SESSION["cart_products"] as $cart_itm) 
     { 
      //set variables to use in content below 
      $product_name = $cart_itm["product_name"]; 
      $product_qty = $cart_itm["product_qty"]; 
      $product_price = $cart_itm["product_price"]; 
      $product_code = $cart_itm["product_code"]; 
      $product_color = $cart_itm["product_color"]; 
      $subtotal = ($product_price * $product_qty); //calculate Price x Qty 

      $bg_color = ($b++%2==1) ? 'odd' : 'even'; //class for zebra stripe 
      echo '<tr class="'.$bg_color.'">'; 
      echo '<td><input type="text" size="2" maxlength="2" name="product_qty['.$product_code.']" value="'.$product_qty.'" /></td>'; 
      echo '<td>'.$product_name.'</td>'; 
      echo '<td>'.$currency.$product_price.'</td>'; 
      echo '<td>'.$currency.$subtotal.'</td>'; 
      echo '<td><input type="checkbox" name="remove_code[]" value="'.$product_code.'" /></td>'; 
      echo '</tr>'; 
      $total = ($total + $subtotal); //add subtotal to total var 
     } 

     $grand_total = $total + $shipping_cost; //grand total including shipping cost 
     foreach($taxes as $key => $value){ //list and calculate all taxes in array 
       $tax_amount  = round($total * ($value/100)); 
       $tax_item[$key] = $tax_amount; 
       $grand_total = $grand_total + $tax_amount; //add tax val to grand total 
     } 

     $list_tax  = ''; 
     foreach($tax_item as $key => $value){ //List all taxes 
      $list_tax .= $key. ' : '. $currency. sprintf("%01.2f", $value).'<br />'; 
     } 
     $shipping_cost = ($shipping_cost)?'Shipping Cost : '.$currency. sprintf("%01.2f", $shipping_cost).'<br />':''; 
    } 
    ?> 
    <tr><td colspan="5"><span style="float:right;text-align: right;"><?php echo $shipping_cost. $list_tax; ?>Amount Payable : <?php echo sprintf("%01.2f", $grand_total);?></span></td></tr> 
    <tr><td colspan="5"><a href="index.php" class="button">Add More Items</a><button type="submit">Update</button></td></tr> 
    <a href="place-order.php" ><img src="images/buynow.jpg" width="179" 
    </tbody> 
</table> 
<input type="hidden" name="return_url" value="<?php 
$current_url = urlencode($url="http://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']); 
echo $current_url; ?>" /> 
</form> 
</div> 

</body> 
</html>

作为一个测试，我复制此页面，把它称为布局order.php，只说：

$sql = "INSERT INTO orders (product_code, product_name, product_price, product_qty) 
VALUES ('$product_code', '$product_name', '$product_price', '$product_qty')"; 

if ($conn->query($sql) === TRUE) { 
    echo "New record created successfully"; 
} else { 
    echo "Error: " . $sql . "<br>" . $conn->error; 
}

这工作过，但只有一个产品被添加到“订单”表。我怀疑它应该与“为每个”或什么？尝试了很多，但不能得到它的工作。任何人都可以指引我正确的方向？

[小博]（http://bobby-tables.com/）说：*** [你的脚本SQL注入攻击的风险。]（http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php）***了解[准备]（http：// en.wikipedia.org/wiki/Prepared_statement）[MySQLi]的声明（http://php.net/manual/en/mysqli.quickstart.prepared-statements.php）。即使[转义字符串]（http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string）是不安全的！ –

答

使用你的语法，你可以像这样插入多行。

INSERT INTO tableName 
    (column1, column2, column3, column4) 
VALUES 
    ('value1', 'value2', 'value3', 'value4'), 
    ('value1', 'value2', 'value3', 'value4'), 
    ('value1', 'value2', 'value3', 'value4');

您可以在您计算小计和总计的现有foreach循环中执行此操作。

请注意，在SQL查询中使用没有清理的变量会导致严重的安全问题。您可以使用例如为mysqli或PDO准备的查询来保护自己。你可以阅读更多关于此这里：

How can I prevent SQL injection in PHP?

http://php.net/manual/en/book.pdo.php

http://php.net/manual/en/mysqli.quickstart.prepared-statements.php

如何在MYSQL表中存储购物车内容（foreach？）

相关推荐