-1
我有一個工作車（請參閱下面的代碼），但現在我想將'content'訂單'MYSQL表中的內容存儲在'dbexample'數據庫中。 添加了'order_number'和'order_status'字段。 這將允許我做一個訂單跟蹤/狀態系統。如何在MYSQL表中存儲購物車內容（foreach？）
我的車看起來是這樣的： （通過「立即購買」我要打開的地方，order.php這就是代碼應該去看看。）
<?php
session_start();
include_once("config.php");
?>
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>View shopping cart</title>
<link href="style/style.css" rel="stylesheet" type="text/css"></head>
<body>
<h1 align="center">View Cart</h1>
<div class="cart-view-table-back">
<form method="post" action="cart_update.php">
<table width="100%" cellpadding="6" cellspacing="0"><thead><tr><th>Quantity</th><th>Name</th><th>Price</th><th>Total</th><th>Remove</th></tr></thead>
<tbody>
<?php
if(isset($_SESSION["cart_products"])) //check session var
{
$total = 0; //set initial total value
$b = 0; //var for zebra stripe table
foreach ($_SESSION["cart_products"] as $cart_itm)
{
//set variables to use in content below
$product_name = $cart_itm["product_name"];
$product_qty = $cart_itm["product_qty"];
$product_price = $cart_itm["product_price"];
$product_code = $cart_itm["product_code"];
$product_color = $cart_itm["product_color"];
$subtotal = ($product_price * $product_qty); //calculate Price x Qty
$bg_color = ($b++%2==1) ? 'odd' : 'even'; //class for zebra stripe
echo '<tr class="'.$bg_color.'">';
echo '<td><input type="text" size="2" maxlength="2" name="product_qty['.$product_code.']" value="'.$product_qty.'" /></td>';
echo '<td>'.$product_name.'</td>';
echo '<td>'.$currency.$product_price.'</td>';
echo '<td>'.$currency.$subtotal.'</td>';
echo '<td><input type="checkbox" name="remove_code[]" value="'.$product_code.'" /></td>';
echo '</tr>';
$total = ($total + $subtotal); //add subtotal to total var
}
$grand_total = $total + $shipping_cost; //grand total including shipping cost
foreach($taxes as $key => $value){ //list and calculate all taxes in array
$tax_amount = round($total * ($value/100));
$tax_item[$key] = $tax_amount;
$grand_total = $grand_total + $tax_amount; //add tax val to grand total
}
$list_tax = '';
foreach($tax_item as $key => $value){ //List all taxes
$list_tax .= $key. ' : '. $currency. sprintf("%01.2f", $value).'<br />';
}
$shipping_cost = ($shipping_cost)?'Shipping Cost : '.$currency. sprintf("%01.2f", $shipping_cost).'<br />':'';
}
?>
<tr><td colspan="5"><span style="float:right;text-align: right;"><?php echo $shipping_cost. $list_tax; ?>Amount Payable : <?php echo sprintf("%01.2f", $grand_total);?></span></td></tr>
<tr><td colspan="5"><a href="index.php" class="button">Add More Items</a><button type="submit">Update</button></td></tr>
<a href="place-order.php" ><img src="images/buynow.jpg" width="179"
</tbody>
</table>
<input type="hidden" name="return_url" value="<?php
$current_url = urlencode($url="http://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
echo $current_url; ?>" />
</form>
</div>
</body>
</html>
作爲一個測試，我複製此頁面，把它稱爲佈局order.php，只說：
$sql = "INSERT INTO orders (product_code, product_name, product_price, product_qty)
VALUES ('$product_code', '$product_name', '$product_price', '$product_qty')";
if ($conn->query($sql) === TRUE) {
echo "New record created successfully";
} else {
echo "Error: " . $sql . "<br>" . $conn->error;
}
這工作過，但只有一個產品被添加到「訂單」表。 我懷疑它應該與「爲每個」或什麼？嘗試了很多，但不能得到它的工作。 任何人都可以指引我正確的方向？
[小博]（http://bobby-tables.com/）說：*** [你的腳本SQL注入攻擊的風險。]（http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php）***瞭解[準備]（http：// en.wikipedia.org/wiki/Prepared_statement）[MySQLi]的聲明（http://php.net/manual/en/mysqli.quickstart.prepared-statements.php）。即使[轉義字符串]（http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string）是不安全的！ –