Best way to implement shopping cart using PHP/MySQL

Question

I'm working on a customer's website, and they've asked for a shopping cart. They need to use securetrading.net for the payment, so I don't need to ask for any credit card details. All I need to do is keep track of the items in their cart.

I've read about using PHP sessions, but I'm concerned about security there. Is this not a problem if the only information I'm storing is product codes and quantities? Otherwise, is it worth using a MySQL database?

I'm sorry if this seems like an obvious thing to know, but this is my first time implementing this kind of thing!

Solution 1

There is tutorial for simple/small php/MySQL cart that keeps cart status in sessions, there is even downloadable demo code and online demo.

http://v3.thewatchmakerproject.com/journal/276/building-a-simple-php-shopping-cart

I used it when full blown online shoping programs were just that "over blown". Same as you there was no need to take cc data, user registration, etc... just siple place to send selected items to payment gateway's purchase proces and after that to forget about it. That is what client wanted, and that is what he got on the end (my first choice was magento but it was too complicated for clients 3 products).

Of course you need to extend it to fit your need but it's good starting point for something simple.

Solution 2

I'd use a prefab open-source solution. You really don't want to let in silly security issues when you're dealing with other people's money.

Magento comes to mind. It's certainly the slickest I've seen in a while... And there appears to be securetrading support if you hack it in yourself.

Solution 3

I'd use PHP sessions since you're only storing product codes/quantities. Yes these are open to "attack" -- but the attack would be something along the lines of changing product codes (make sure you add a check for valid codes before passing info to your payment gateway) and quantities (again do a check for quantity on hand if need be)

Session variables are open to attack by users but if someone wants to "trick" my system and checkout 4 items instead of 1 it's really not a problem at all.

Comments

[Skilldrick]

I feel like I'm missing something here. All I really need is a record of the item numbers and quantities so they can be passed on to the securetrading form - surely this is really simple?

[bicycle]

But remember that trying to 4 instead of 1 is not good enough. What is more important and mostly overlooked that it's not possible to check out with negative numbers or with a zero.

[Sahan Pasindu Nirmal]

Then what you suggest to do handle guest user cart handling? Session cannot maintain for long period, also cookies work only for one browser, then what are the suggestions? I have the same problem while developing my project