PHP shopping cart without database?
M1911
might sound weird but I've set up one a few times that was written in
perl (not by me) and it can be very handy, especially for someone with
only a few products. That one took information about products from the
form action and then functioned just like a typical cart. You had to put
your product name, description, price, etc. in the html link from each
product to the script, but there was no database involved. If anyone
knows of anything like this in PHP please post the links.
Thanks
SpEaRmAn
--
--
* Please visit my website: www.OvertechTechnologies.com/go.php?id=kyle
* Make money with yours: http://overtech.kicks-ass.net:81/
"M1911" <nom...@no.mail> wrote in message news:3ED93089...@no.mail...
M1911
I looked through hotscripts.com but I didn't see anything that fit what
I'm looking for. Do you know of one there does what I'm looking for?
Ruben van Engelenburg
> Is there a PHP shopping cart available that works without a database. It
> might sound weird but I've set up one a few times that was written in
> perl (not by me) and it can be very handy, especially for someone with
> only a few products. That one took information about products from the
> form action and then functioned just like a typical cart. You had to put
> your product name, description, price, etc.
[snip]
Keep in mind that this is very insecure. Even if security is only
slightly important to you, you should never use a script that works like
that.
Regards,
Ruben.
M1911
In what way is it insecure? The perl version I've seen was set up so
only allowed domains could post to the cart. So someone could not just
alter the html and submit from their PC or some other domain. Other than
that, why would it be less secure than a cart that pulls info from a
database?
Drazen Gemic
> Ruben van Engelenburg wrote:
>
You can have very easy and simple database using serialization.
I hope it helps.
DG
Ruben van Engelenburg
[snip]
>>Keep in mind that this is very insecure. Even if security is only
>>slightly important to you, you should never use a script that works like
>>that.
>>
>>Regards,
>>Ruben.
>
>
> In what way is it insecure? The perl version I've seen was set up so
> only allowed domains could post to the cart. So someone could not just
> alter the html and submit from their PC or some other domain. Other than
> that, why would it be less secure than a cart that pulls info from a
> database?
You wrote this in your original post:
" That one took information about products from the
form action and then functioned just like a typical cart. You had to put
your product name, description, price, etc."
In such a setup a user can easily modify the price. The user can check
out the HTML source of the form to see what the name of the price key
is, say "price". He'll also check the form action, say "cart.cgi".
After he's got all info he needs, he'll submit the data himself instead
of using the form, by going to:
http://www.yourshop.com/cart.cgi?product=10&price=8
This is just an example, but you get the point. Very easy to circumvent
the hidden values in the form, which would normally be stored in a
database instead of in the formdata.
Regards,
Ruben.
M1911
> You wrote this in your original post:
>
> " That one took information about products from the
> form action and then functioned just like a typical cart. You had to put
> your product name, description, price, etc."
>
> In such a setup a user can easily modify the price. The user can check
> out the HTML source of the form to see what the name of the price key
> is, say "price". He'll also check the form action, say "cart.cgi".
> After he's got all info he needs, he'll submit the data himself instead
> of using the form, by going to:
> http://www.yourshop.com/cart.cgi?product=10&price=8
>
> This is just an example, but you get the point. Very easy to circumvent
> the hidden values in the form, which would normally be stored in a
> database instead of in the formdata.
>
> Regards,
> Ruben.
That is possible but it's not really a problem in the situations where I
would use it. The orders are all looked over by a human after they are
submitted and price changes would be spotted. The product line is small
and the merchants know their products and don't use real time cc
processing online. It's the same situation as someone filling out an
order form manually. The cart is just for convenience and more
professionalism. But it probably would not be a solution for a large
company with many products and employees who don't know the products
well enough to spot that type of thing.
William L. Berggren
You could also send the form to another php page to verify the data if
you want to. No database required. For small amount of items less
than 30 the best way would be to include a data file imho
switchblade.price = "5.99";
switchblade.url = "switch.htm";
switchblade.pitch = "Cuts though skin like a watermelon";
switchbade.image = "./images/blade.png";
hachett.price="7.99";
Jordan Smith
I would never recommend that method. You should be made aware that
there are databases such as mySQL etc, and then there are flat file
databases which jus consist of files that sit on the server. This is
not as secure or as fast as other methods but there is no extra SW
needed because your shoppong cart script uses its own flat file
database.
A falt file databse is just a bunch of files, maybe a file for each
product... it all depends on how it is coded, but I hope you get the
idea...
M1911
>
> M1911 <nom...@no.mail> wrote in message news:<3ED93089...@no.mail>...
> > Is there a PHP shopping cart available that works without a database. It
> > might sound weird but I've set up one a few times that was written in
> > perl (not by me) and it can be very handy, especially for someone with
> > only a few products. That one took information about products from the
> > form action and then functioned just like a typical cart. You had to put
> > your product name, description, price, etc. in the html link from each
> > product to the script, but there was no database involved. If anyone
> > knows of anything like this in PHP please post the links.
> >
> > Thanks
>
> I would never recommend that method.
Why not?
William L. Berggren
I would recommend either embedding the product in index.php, using one
.inc file, or having a directory called products with one file per
product that is the php script can read 1-50 products as needed. It
will be much faster since you don't use the overhead and wasted code
of a database.
flat files is a term database lovers use to discredit text files.
flat sounds dead, while sql sounds sophisticated.