mysql_query sum results

Question

I am completely lost and need help! I'll be the first to admit that I'm no expert so if you ask why I did something the way I did, the answer is simple, I try stuff until it works. However, I cannot get this one straight. All I need to do is add up an array (guessing its an array). If you take a look you can see that my code finds the order id from the url with $_GET["id"] then puts all products ordered for that order in an array. And finally get the cost of each product in the order. With the code as it is, it lists the cost for every produced ordered. What I would like to do is get the sum for the cost of every product in the order. Might be 1 product for one order the 10 for the next so it would have to be dynamic. !?!I GUESS!?!

Thank in advance and sorry for the lengthy post.

$orderdetails = mysql_query("SELECT * FROM  cscart_order_details WHERE order_id='" . $_GET["id"] . "'") 
or die(mysql_error()); 
    while($odinfo = mysql_fetch_array( $orderdetails )) 
        {

            $products = mysql_query("SELECT * FROM  cscart_products WHERE product_id='" . $odinfo['product_id']  ."'") 
            or die(mysql_error()); 

                while($pinfo = mysql_fetch_array( $products ))
                    {   
                        echo "<tr class='table-rowwithouthover'><td>Product Cost: $" . $pinfo['cost'] . "</td>";
                    }   
        }

Answer 1

Just by looking at your code, you are vulnerable to sql injections.

If you want to add up the total cost of the order, can't you just use a variable to do this? Or have I misunderstood the question?

 $totalCost = 0;
 while($pinfo = mysql_fetch_array( $products )){   
    $totalCost += $pinfo['cost'];
 }
 echo "The total cost of your order is: $".$totalCost;