Here is a modern frontend implementation using the Fetch API.
<!-- product_list.php -->
<!DOCTYPE html>
<html lang="en">
<head>
<title>High Quality Cart Demo</title>
</head>
<body>
<!-- Example Product Button -->
<div class="product-card">
<h3>Wireless Headphones</h3>
<p>Price: $99.00</p>
<input type="number" id="qty-101" value="1" min="1">
<button onclick="addToCart(101)">Add to Cart</button>
</div>
<div id="notification" style="display:none; background: #dff0d8; padding: 10px;"></div>
<script>
function addToCart(productId)
// Get quantity from input
let numInput = document.getElementById('qty-' + productId);
let quantity = numInput ? numInput.value : 1;
let formData = new FormData();
formData.append('product_id', productId);
formData.append('num', quantity);
fetch('add_cart.php',
method: 'POST',
body: formData
)
.then(response => response.json())
.then(data =>
const notif = document.getElementById('notification');
if (data.status === 'success')
notif.style.display = 'block';
notif.innerText = data.message;
console.log('Cart count:', data.cart_count);
else
notif.style.display = 'block';
notif.style.background = '#f2dede';
notif.innerText = data.message;
// Hide notification after 3 seconds
setTimeout(() => notif.style.display = 'none'; , 3000);
)
.catch(error => console.error('Error:', error));
</script>
</body>
</html>
A high-quality backend needs an equally robust frontend. Use JavaScript to enforce numeric integrity before the request reaches addcartphp.
<input type="number" id="quantity" name="num" min="1" max="99" step="1" value="1"> <button id="add-to-cart">Add to Cart</button><script> document.getElementById('add-to-cart').addEventListener('click', async () => num > 99) alert('Please enter a quantity between 1 and 99'); return;
const response = await fetch('add_to_cart.php', method: 'POST', headers: 'Content-Type': 'application/x-www-form-urlencoded' , body: `product_id=123&num=$num&csrf_token=$csrfToken` ); const result = await response.json(); if (result.success) updateCartUI(result.cart_count); else alert(result.error);
); </script>
Below is the complete, production-ready addcart.php script. Note how it handles the num parameter with rigorous validation.
<?php // addcart.php - High Quality Implementation session_start(); require_once 'config/database.php'; require_once 'includes/csrf.php'; require_once 'includes/sanitize.php';// Only accept POST requests for security if ($_SERVER['REQUEST_METHOD'] !== 'POST') http_response_code(405); die(json_encode(['error' => 'Method not allowed']));
// Validate CSRF token (prevents cross-site request forgery) if (!validateCsrfToken($_POST['csrf_token'] ?? '')) http_response_code(403); die(json_encode(['error' => 'Invalid security token'])); addcartphp num high quality
// Get and sanitize inputs $product_id = filter_input(INPUT_POST, 'id', FILTER_VALIDATE_INT); $requested_num = filter_input(INPUT_POST, 'num', FILTER_VALIDATE_INT);
// --- HIGH QUALITY VALIDATION BLOCK --- if (!$product_id || $product_id <= 0) die(json_encode(['error' => 'Invalid product ID']));
// Quantity validation: ensure num is between 1 and a reasonable max (e.g., 999) if ($requested_num === false || $requested_num === null) $requested_num = 1; // default $requested_num = max(1, min(999, $requested_num)); // clamp between 1 and 999
// --- DATABASE LOOKUP (Prepared Statement) --- $pdo = getDbConnection(); $stmt = $pdo->prepare("SELECT id, name, price, stock_quantity FROM products WHERE id = ? AND status = 1"); $stmt->execute([$product_id]); $product = $stmt->fetch(PDO::FETCH_ASSOC);
if (!$product) die(json_encode(['error' => 'Product not found or unavailable']));
// Check stock availability $available_stock = (int)$product['stock_quantity']; $final_quantity = $requested_num;
if ($final_quantity > $available_stock) // High quality: clip to available stock and notify user $final_quantity = $available_stock; $stock_warning = "Only $available_stock items available. Quantity adjusted."; Here is a modern frontend implementation using the Fetch API
if ($final_quantity === 0) die(json_encode(['error' => 'Out of stock']));
// --- SESSION CART MANAGEMENT (High quality structure) --- if (!isset($_SESSION['cart'])) $_SESSION['cart'] = [];
$cart = &$_SESSION['cart']; // reference for performance
// Update or add item if (isset($cart[$product_id])) // Update existing: sum quantities but respect stock $new_total = $cart[$product_id]['quantity'] + $final_quantity; if ($new_total > $available_stock) $new_total = $available_stock; $stock_warning = "Stock limit reached. Cart updated to max available."; $cart[$product_id]['quantity'] = $new_total; else $cart[$product_id] = [ 'id' => $product['id'], 'name' => htmlspecialchars($product['name']), // XSS protection 'price' => (float)$product['price'], 'quantity' => $final_quantity, 'max_stock' => $available_stock ];
// --- OPTIONAL: Sync with database for logged-in users --- if (isset($_SESSION['user_id'])) $upsert = $pdo->prepare(" INSERT INTO user_carts (user_id, product_id, quantity) VALUES (?, ?, ?) ON DUPLICATE KEY UPDATE quantity = ? "); $upsert->execute([$_SESSION['user_id'], $product_id, $cart[$product_id]['quantity'], $cart[$product_id]['quantity']]);
// --- RESPONSE (JSON for AJAX, or redirect) --- if (!empty($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') // AJAX request: return JSON header('Content-Type: application/json'); echo json_encode([ 'success' => true, 'message' => $stock_warning ?? "Product added to cart", 'cart_count' => array_sum(array_column($cart, 'quantity')), 'item_quantity' => $cart[$product_id]['quantity'] ]); else // Traditional form submit: redirect back with message $_SESSION['flash_message'] = $stock_warning ?? "Product added successfully"; header("Location: " . $_SERVER['HTTP_REFERER'] ?? '/cart.php'); exit();
Before writing code, understand what a premium "add to cart" operation entails.
To support addcartphp num high quality, you need a normalized database structure.
-- Products table CREATE TABLE `products` ( `id` INT(11) UNSIGNED AUTO_INCREMENT PRIMARY KEY, `sku` VARCHAR(50) NOT NULL, `name` VARCHAR(255) NOT NULL, `price` DECIMAL(10,2) NOT NULL, `stock_quantity` INT(11) NOT NULL DEFAULT 0, `status` TINYINT(1) DEFAULT 1, INDEX `idx_stock` (`stock_quantity`, `status`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
-- Optional: Persistent carts (for logged-in users) CREATE TABLEuser_carts(idINT(11) UNSIGNED AUTO_INCREMENT PRIMARY KEY,user_idINT(11) UNSIGNED NOT NULL,product_idINT(11) UNSIGNED NOT NULL,quantityINT(11) UNSIGNED NOT NULL,added_atTIMESTAMP DEFAULT CURRENT_TIMESTAMP, UNIQUE KEYunique_user_product(user_id,product_id) ) ENGINE=InnoDB;
Session-based carts are fine for guests, but logged-in users expect cart persistence across devices. Let's upgrade.
Quantity updates should respect real-time inventory. Before adding or updating:
$availableStock = getProductStock($productId);
if ($requestedQuantity > $availableStock)
// Return error or cap at availableStock
This prevents overselling and supports high-quality inventory management. A high-quality backend needs an equally robust frontend