Add-cart.php Num -

– 11:34:02.447 POST /add-cart.php HTTP/1.1 – 11:34:02.451 POST /add-cart.php HTTP/1.1 – 11:34:02.453

Instead, he clicked over to the user's profile. gh0st_walker had been a member for four years. Bought three pairs of boots, left glowing reviews each time. Their last order was a size 11—the same size in the ghost cart.

Leo swore under his breath. No BEGIN TRANSACTION . No FOR UPDATE . Just two naïve queries and a prayer. The three simultaneous POSTs had each run the SELECT , seen an empty cart, and each fired an INSERT . Three rows. Same product. add-cart.php num

He closed the file. He'd fix add-cart.php tomorrow.

The server logs didn't blink. They never did. But for Leo, the silent, green-on-black text of /var/log/nginx/access.log might as well have been a screaming headline. – 11:34:02

Tonight, he'd let the ghost walker win. The next morning, a new commit appeared on the main branch: fix: add unique constraint and row-level locking to add-cart.php (thanks gh0st_walk3r for the pentest)

Leo leaned back in his creaking office chair, the glow of three monitors painting his tired face in pale blue light. He was the senior backend engineer for Velvet & Sole , a boutique online shoe retailer that had, against all odds, become a cult hit. Their signature "Dragonhide 7X" boot sold out in eleven minutes every restock. Their last order was a size 11—the same

<?php // Legacy code. No locking. No transactions. $product_id = $_POST['product_id']; $user_id = $_SESSION['user_id']; $quantity = 1; // default // Check if item exists in cart $result = $db->query("SELECT * FROM cart WHERE user_id=$user_id AND product_id=$product_id"); if($result->num_rows == 0) { $db->query("INSERT INTO cart (user_id, product_id, quantity) VALUES ($user_id, $product_id, $quantity)"); } else { $db->query("UPDATE cart SET quantity = quantity + $quantity WHERE user_id=$user_id AND product_id=$product_id"); } ?>