Cart not functioning properly

[astonecipher]

t is completely open to sql injection.
Where? I know there are nicer ways but with an int there is not too much possible to inject

$result = mysqli_query($connect, "SELECT id, pname, image, price FROM products WHERE id=" . $product_id);

https://www.php.net/manual/en/mysqli.prepare.php

You are using table for layout.
And? Less responsive but valid html

Granted that’s how it was normally done in html 4, but things have changed a lot and this is no longer the norm. So, enforcing bad practices doesn’t help anyone learn how to do things properly.

Using to many details in the cart.
why?

       $cart[$product_id] = array(
            'product_id' => $product_id,
            'item_name' => $product["pname"], // get name from the database so that users cannot mess with it
            'product_price' => $product["price"], // get price from the database so that users cannot mess with the prices either
            'item_quantity' => $qty,
            'image' => $_GET["image"]
        );

The cart is identified by the product id, so you now have something like:
Array(
[123] => “product_id” = 123

Why would the image be in the GET array? All you actually need is the product id and quantity; everything else should be looked up when you view the cart or submit an order.

I was just trying to point something out, but you got offended. Show him the Symfony way of doing things. It may be over his head at the moment, but it builds a great (and correct) foundation to grow from.