Question

I am building a really simple groupon like script for learning purposes now in holidays. What I posted below is the code that shows a deal and you have the option to buy it. When you click on buy, you are moved to checkout.php that displays also some info about the requested product.
deal.php

$dealid = (int)$_GET["id"];

$query = "SELECT * FROM products WHERE id = $dealid LIMIT 1";
$row = mysql_fetch_array(mysql_query($query));

echo $row['name'];
echo '<br>';
echo '<a href="checkout.php?id='. $row['id'] .'">buy</a>';

checkout.php

$dealid = (int)$_GET["id"];

$query = "SELECT * FROM products WHERE id = $dealid LIMIT 1";
$row = mysql_fetch_array(mysql_query($query));

echo $row['name'];

What I want to learn is if what I posted is a good way to do this. I guess not. My goal is to pass some data from deal to checkout through a link or a button like image and I don’t want to pass for example the title from the url.

What I have in mind is this http://www.groupon.com/st-johns/ where when you click the buy image you proceed to the next step that contains info of the requested to buy deal.

Thank you.

Answer 1

Store the information in a $_SESSION variable.

session_start();
$_SESSION['zipCode'] = "01879";

//zipCode now available on all pages that call session_start()

This allows you to store information for the life of the user’s session. When the session is destroyed (user navigates away, closes browser, etc.), the information is no longer there. Alternatively, you can use cookies to store this information long-term.

Addition

These methods are also more secure than storing the information on the page, as users can modify the DOM elements on the page using a DOM inspector, which most browsers now have. The most secure method is using sessions, as cookie information can also be changed, but is relatively safe if you validate the information there first.