在SESSION变量中无法将新id与id匹配

Question

Using PHP, my objective is to prevent the addition of a duplicate ID into a SESSION cart. The ID is passed from a form. The error message works for the first item only. Other items already in the cart bypass the conditional statement and are added to the array, although the first item at any point gets caught by it. Various trial and error remedies have failed.

Any assistance is appreciated. Let me know if this challenge is not described clearly. Thank you in advance.

Here's the code:

// If user clicks add button
if(isset($_POST['action']) && $_POST['action'] === 'Add'){ 

// If cart has content, check if new content already in cart
if(!empty($_SESSION['cart'])){

    foreach($_SESSION['cart'] as $id){
        if($_POST['id'] === $id){
            $errMsg = 'Item ' . $_POST['id'] . ' already in cart.';
            include 'error.html.php';
            exit();                                              
        }else{
           // Add new content to cart
           $_SESSION['cart'][] = $_POST['id'];
           header('Location: .');
           exit();
        }
    }          
}

Answer 1

try this code, it should work, also there was an xss vulnerability in this code so i fixed it too.

read owasp's guide for more info https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

<?php
session_start();
// If user clicks add button
if($_POST['action'] === 'Add'){
    if(in_array($_POST['id'], $_SESSION['cart'])){
        $errMsg = 'Item ' . htmlentities($_POST['id'],ENT_QUOTES) /* Cross Site Scripting */ . ' already in cart.';
        include 'error.html.php';
        exit();
    }
    // Add new content to cart
    $_SESSION['cart'][] = $_POST['id'];
    header('Location: .');
    exit();
}