I am using the following php code with a form which updates a table. However I want to add a javascript variable to the sql so that the variable will be added to a column in the database. The variable is in a different file to the php.
php :=
$name = $_POST['firstname'];
$lastname = $_POST['lastname'];
$userAddress = $_POST['address'];
$userPostCode = $_POST['postcode'];
$delivery = $_POST['deliverytype'];
$sql = "INSERT INTO USERS (FIRSTNAME, SECONDNAME, ADDRESS, POST_CODE, DELIVERY_TYPE) VALUES ('$name', '$lastname', '$userAddress', '$userPostCode', '$delivery') ";
$conn->exec($sql);
i then want to add to that a totalcost variable from the following javascript that will go in Total_Order_Cost and $totalCost
here is the js function that i wish to take the variable totalPrice from
function displayBasket(){
basket = document.getElementById("basket");
string = "";
var basketStorage = localStorage.getItem("basket");
jsonBasket = JSON.parse(basketStorage);
var totalPrice = 0;
itemTotal = 0;
for (var property in jsonBasket){
var qPrice = jsonBasket[property ].quantity * jsonBasket[property ].cost;
var total = jsonBasket[property ].quantity;
string += "<section id='basketPageSection'>";
if(jsonBasket.hasOwnProperty(property )){
string += "<p>Item: " + jsonBasket[property ].name + "</p>";
string += "<p>Price: £" + jsonBasket[property ].cost + "</p>";
string += "<p>Quantity: " + jsonBasket[property ].quantity + "</p>";
}
totalPrice += qPrice;
itemTotal += total;
string += "</section>";
}
string += "<section id='basketSection'> <h3> Total Cost: £" + parseFloat(totalPrice).toFixed(2) + "</h3></section>"
basket.innerHTML = string;
displayQuant();
}
SQL Injection. Have a look atPrepared Statements.