PHPBuilder.com has continued their series looking at building an Ajax-driven shopping cart with part two posted today (part one here). Last time they laid the PHP foundation for the example app, this time they add another layer - the Ajax functionality to manage the current contents of the cart.

Finally, a link to the shopping cart is provided, although you could just as easily have displayed the cart contents on the same page. For the sake of brevity I'll just show you how to integrate the add feature, and will leave the subtraction mechanism to you as an exercise.

The Ajax frontend calls a managecart.php backend file that calls addToCart and deleteFromCart based on which type of "task" is passed to it.

On CyberDummy's blog today, there's a quick post that points to a handy script over on the script.aculo.us library - a drag-and-drop shopping cart.

Just discovered the the excellent script.aculo.us drag and drop shopping cart. It is implemented with the script.aculo.us javascript library and ruby on rails. It is a perfect fit for a project I am working on but I needed a PHP version here is the rough first draft with source code.

I can definitely see something like this being the next step in ecommerce sites. No more hitting "Add to Cart" and waiting for the page to refresh, view the cart, then hit "Continue Shopping". Simply drag it in and it pops right up...

On his blog today, Robert Peake has a post with a fix for a rather large issue with the Zen Cart software - a SQL injection vulnerability.

One thing that really irks me is when people publish security vulnerabilities they discover without publishing the fix. Doing so only benefits the hacker (most specifically, the script kiddie) community, begging the question, "which side are you on?" Whenver I discover a vulnerability or exploit, I make it a point to first and foremost contact the vendor (or group responsible if it is not a commercial product) and then only announce the exploit after a fix is available (if then).

Not enlisting vendor support or at very least describing how a vulnerability can be patched does not help users of that software unless they are savvy enough to figure out the fix on their own. One such example is the announcement of a SQL injection vulnerability in Zen-Cart <= 1.2.6d.

He Goes through the two steps needed to fix the issue, and includes substitution code to correct the injection problem. I definitely agree with his sentiment about reporting and trying to offer a fix for the problem before just sharing it with the world. Sure, there are the people out there that can spot the problem and offer up their own patch, but there seems to (unfortunately) be more out there that would rather abuse it...

On our sister site, AjaxDeveloper.org today, there's a new pointer to a blog post from Patrick on the creation of a Simple AJAX/PHP Shopping Cart.

I recently read an article from John Wiseman on creating a MySQL connection with AJAX (article link). Being a newcomer to the AJAX world I've found many tutorials and code libraries to be rather bloated and presumptious. John's article however was right on target and really got me going in the write direction to start thinking about AJAX and how it should work.

Given that article I started tinkering around and wound up creating a simple shopping cart application for a client. Below is a scaled down version of said application that hopefully can help you along in your AJAX travels.

There's plenty of code here to get you started, including the database structure, all availible for download. He doesn't explain much of it, but he does show where the Ajax is used - adding/removing/etc products from the shopping cart...