PHP Script for updating Shopping Cart

Current backend pattern: validate input and return JSON

The cart-update endpoint should accept only validated integer IDs and quantities, update the session, and return a predictable JSON response. Product prices should always come from the database later, not from the request.

<?php
session_start();
header('Content-Type: application/json; charset=utf-8');

$productId = filter_input(INPUT_POST, 'p_id', FILTER_VALIDATE_INT);
$quantity = filter_input(INPUT_POST, 'qty', FILTER_VALIDATE_INT);

if ($productId === false || $productId === null || $quantity === false || $quantity === null) {
    http_response_code(422);
    echo json_encode(['ok' => false, 'message' => 'Invalid product or quantity.']);
    exit;
}

$quantity = max(0, min(10, $quantity));
$_SESSION['cart'] = (isset($_SESSION['cart']) && is_array($_SESSION['cart'])) ? $_SESSION['cart'] : [];

if ($quantity === 0) {
    unset($_SESSION['cart'][$productId]);
} else {
    $_SESSION['cart'][$productId] = $quantity;
}

echo json_encode([
    'ok' => true,
    'size_of_cart' => count($_SESSION['cart'])
]);
?>

For a real shop, also add CSRF protection, authentication where appropriate, stock checks, and server-side checkout validation.