-3

im making an ecommerce website and since it have different products like phone clothes etc .. the product variables are differents so i made three tables one for the product[idpname,description,photo] , the secend table for the variable[idv,idp,name] and the third one for the varibale details[idv,name,quantity,price] i made a form with option that i show from the database but the probelme is how can i insert the user choice into shopping cart table also the html and php code is wrong

<form method="post" id="my">
<?php
        $req_option=mysqli_query($conn,"select * from optionp where idp=$idp");               
        while($data_option=mysqli_fetch_assoc($req_option)){
                $ido = $data_option['ido'];
    ?>

<p class="text-dark font-weight-medium mb-0 mr-3"><?php echo $data_option['nomo'];  ?>&nbsp;:</p>
    <?php 
        $req_option_detail=mysqli_query($conn,"select * from optiondetail where ido=$ido");               
        while($data_option_detail=mysqli_fetch_assoc($req_option_detail)){
    ?>
    <div class="custom-control custom-radio custom-control-inline">
        <input type="radio" class="custom-control-input" id="<?php echo $data_option_detail['idod'];  ?>" name="optionp" value="<?php echo $data_option_detail['nomdo'];  ?>">
        <label class="custom-control-label" for="<?php echo $data_option_detail['idod'];  ?>"><?php echo $data_option_detail['nomdo'];  ?></label>
    </div>
    <?php } ?><?php } ?>
</form>
Barmar
  • 741,623
  • 53
  • 500
  • 612
Mohcine Lahouircha
  • 1
  • 5
    Welcome to Stack Overflow! Your script is vulnerable to [SQL Injection Attack](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php). Even if [you are escaping variables, its not safe](https://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string%5D)! You should always use [prepared statements and parameterized queries](https://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php) in either MYSQLI or PDO instead of concatenating variables into the query. – Barmar Aug 24 '23 at 23:09
  • You need to use a different name for the radio buttons for each product. Radio buttons are grouped using the name, and each product should be a different grouop. – Barmar Aug 24 '23 at 23:11

0 Answers0