Shopping cart deletes all quantities instead of one

Question

I'm attempting to create a simple shopping cart in PHP. I have managed to add items to a session. If you add the same item the quantity updates.

However when I delete an item that has a quantity of more than 1 it will delete everything for that item rather than taking away 1 from the quantity.

I'm wondering if anyone could check what I might be doing wrong?

Takes the ID of the product:

<a href="checkout.php?id=<?php echo $earthProducts -> id; ?>"> Order Now </a>

I have an Item class:

<?php
Class Item{
var $id;
var $name;
var $price;
var $quantity;
}
?>

On the checkout page it will display all products that are currently in the cart:

require 'item.php';

    if (isset($_GET['id'])) {
        $result = mysqli_query($con, 'SELECT * FROM earthProducts WHERE id=' . $_GET['id']);
        $earthProducts = mysqli_fetch_object($result);
        $item = new Item();
        $item->id = $earthProducts->id;
        $item->name = $earthProducts->name;
        $item->price = $earthProducts->price;
        $item->quantity = 1;

        // Check product is existing in cart
        $index = -1;
        $cart = unserialize(serialize($_SESSION['cart']));
        for ($i = 0; $i < count($cart); $i++)
            if ($cart[$i]->id == $_GET['id']) {
                $index = $i;
                break;
            }
        if ($index == -1) {
            $_SESSION['cart'] [] = $item;
        } else {
            $cart[$index]->quantity++;
            $_SESSION['cart'] = $cart;
        }
    }
    ?>

I then print the cart with a button to delete that item:

<table cellpadding="2" cellspacing="2" border="1">
                    <tr>
                        <th>Option</th>
                        <th>Id</th>
                        <th>Name</th>
                        <th>Price</th>
                        <th>Quantity</th>
                        <th>Sub Total</th>
                    </tr>
                    <?php
                    $cart = unserialize(serialize($_SESSION['cart']));
                    $s = 0;
                    $index = 0;
                    for ($i = 0; $i < count($cart); $i++) {
                        $s += $cart[$i]->price * $cart[$i]->quantity;
                        ?>
                        <tr>
                            <td> <a href="checkout.php?index=<?php echo $index; ?>" onclick="return confirm('Are you sure?')">Delete</td>
                            <td><?php echo $cart[$i]->id; ?></td>
                            <td><?php echo $cart[$i]->name; ?></td>
                            <td><?php echo $cart[$i]->price; ?></td>
                            <td><?php echo $cart[$i]->quantity; ?></td>
                            <td><?php echo $cart[$i]->price * $cart[$i]->quantity; ?></td>
                        </tr>
                        <?php
                        $index++;
                    }
                    ?>
                    <tr>
                        <td colspan="4" align="right">Sum</tr>
                    <td align="left"> <?php echo $s ?></td>
                </table>
                <br>
                <a href="earth_products.php"> Continue Shopping </a>

                <br>
                <br>
                <?php
                print_r($cart);
                ?>

My code to delete an item in the cart (Which is wrong):

// Delete product in cart
    if (isset($_GET['index'])) {
        $cart = unserialize(serialize($_SESSION['cart']));
        unset($cart[$_GET['index']]);
        $cart = array_values($cart);
        $_SESSION['cart'] = $cart;
    }

So if I have item-1 with quantity of 1, I press delete which will remove it. If I have item-2 with a quantity of 2 it will delete both quantities and remove item-2 from the cart.

Thank you in advance if anyone can assist with this.

Answer 1

You need to decrease the quantity of an Item instead of just removing it, as when the quantity is bigger than 1, your code will just delete the item completely from the cart.

Additionally, it is very dangerous to use $_GET variables directly in SQL code, this makes it very easy to make an SQL injection and dump your database.

Answer 2

You need to check quantity before unsetting, Something like this should work:

if (isset($_GET['index'])) {
    $cart = unserialize(serialize($_SESSION['cart']));
    if ($cart[$_GET['index']]->quantity == 1){
       unset($cart[$_GET['index']]);
    }else{
       $cart[$_GET['index']]->quantity--;
    }
    $cart = array_values($cart);
    $_SESSION['cart'] = $cart;
}