How can PHP form handling be improved to ensure the correct item is purchased from a database?

To ensure the correct item is purchased from a database, the PHP form handling can be improved by validating the user input against the items available in the database before processing the purchase. This can be done by querying the database to check if the item exists and is in stock before allowing the purchase to proceed. 

// Connect to the database
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "database";

$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Validate user input
$item_id = $_POST['item_id'];
$sql = "SELECT * FROM items WHERE id = $item_id AND stock > 0";
$result = $conn->query($sql);

if ($result->num_rows > 0) {
    // Item exists and is in stock, proceed with purchase
    // Add code here to process the purchase
} else {
    // Item does not exist or is out of stock
    echo "Item not available for purchase.";
}

// Close the database connection
$conn->close();

Keywords

PHP form handling database validation SQL injection

Related Questions