A request to add-cart.php?num=1.1 returns a MySQL error: "Unknown column '1.1' in 'where clause'" — SQL injection confirmed.

In the world of e-commerce development, few scripts are as ubiquitous—and as notoriously vulnerable—as add-cart.php . At first glance, it seems harmless: a simple backend handler that adds a product to a user’s shopping cart. But when you see a URL like https://example.com/add-cart.php?num=1 , alarms should go off for any experienced developer.

// In the form that calls add-cart $_SESSION['csrf_token'] = bin2hex(random_bytes(32)); echo '<input type="hidden" name="csrf_token" value="'.$_SESSION['csrf_token'].'">'; // In add-cart.php if (!hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) die('CSRF attack detected');

An attacker should not be able to call add-cart.php 1000 times per second. Implement a token bucket or store a timestamp in the session:

If you currently have add-cart.php?num= in production, stop reading and go audit it now. Your users’ data—and your business—depend on it.