[PROJECT] nopXcart - ecommerce integration with MODx

$table = $modx->getFullTableName("nopXorders");
$sql = "INSERT INTO $table
VALUES('$oid','$today','$$b_first','$b_last','$b_addr','$b_addr2','$b_city','$b_state','$b_zip','$b_phone','$b_email','$$s_first','$s_last','$s_addr','$s_addr2','$s_city','$s_state','$s_state','$s_state','$s_zip','$s_phone','$s_email','$QUANTITY_1','$PRICE_1','$ID_1','$NAME_1','$ADDTLINFO_1','$QUANTITY_2','$PRICE_2','$ID_2','$NAME_2','$ADDTLINFO_2','$QUANTITY_3','$PRICE_3','$ID_3','$NAME_3','$ADDTLINFO_3','$QUANTITY_4','$PRICE_4','$ID_4','$NAME_4','$ADDTLINFO_4','$QUANTITY_5','$PRICE_5','$ID_5','$NAME_5','$ADDTLINFO_5','$QUANTITY_6','$PRICE_6','$ID_6','$NAME_6','$ADDTLINFO_6','$QUANTITY_7','$PRICE_7','$ID_7','$NAME_7','$ADDTLINFO_7','$QUANTITY_8','$PRICE_8','$ID_8','$NAME_8','$ADDTLINFO_8','$QUANTITY_9','$PRICE_9','$ID_9','$NAME_9','$ADDTLINFO_9','$QUANTITY_10','$PRICE_10','$ID_10','$NAME_10','$ADDTLINFO_10','$QUANTITY_11','$PRICE_11','$ID_11','$NAME_11','$ADDTLINFO_11','$QUANTITY_12','$PRICE_12','$ID_12','$NAME_12','$ADDTLINFO_12','$QUANTITY_13','$PRICE_13','$ID_13','$NAME_13','$ADDTLINFO_13')";
$modx->db->query($sql);

$sql = "CREATE TABLE 'nopXorders' ('Order ID','Date','First Name','Last Name','Address1','Address2','City','State','Zip','Phone','Email','sFirst Name','sLast Name','sAddress1','sAddress2','sCity','sState','sZip','sPhone','sEmail','Quant1','Price1','ID1','Name1','AddtlInfo1','Quant2','Price2','ID2','Name2','AddtlInfo2','Quant3','Price3','ID3','Name3','AddtlInfo3','Quant4','Price4','ID4','Name4','AddtlInfo4','Quant5','Price5','ID5','Name5','AddtlInfo5','Quant6','Price6','ID6','Name6','AddtlInfo6','Quant7','Price7','ID7','Name7','AddtlInfo7','Quant8','Price8','ID8','Name8','AddtlInfo8','Quant9','Price9','ID9','Name9','AddtlInfo9','Quant10','Price10','ID10','Name10','AddtlInfo10','Quant11','Price11','ID11','Name11','AddtlInfo11','Quant12','Price12','ID12','Name12','AddtlInfo12','Quant13','Price13','ID13','Name13','AddtlInfo13')";
$modx->db->query($sql);

<?php
$tblNameOrders = "nopXorders";
$tblNameItems = "nopXitems";

function createTable($tblNameOrders, $tblNameItems, $tblType) {
	global $modx;
	if ($tblType == 'orders') {
		$sql="CREATE TABLE $tblNameOrders (
			`order_id` int(10) unsigned NOT NULL,
			`date` datetime NOT NULL,
			`firstname` varchar(100) NOT NULL,
			`lastname` varchar(100) NOT NULL,
			`address1` varchar(100) NOT NULL,
			`address2` varchar(100) default NULL,
			`city` varchar(100) NOT NULL,
			`state` varchar(100) default NULL,
			`zip` int(10) NOT NULL,
			`phone` varchar(100) NOT NULL,
			`email` varchar(100) NOT NULL,
			`secondary_firstname` varchar(100) default NULL,
			`secondary_lastname` varchar(100) default NULL,
			`secondary_address1` varchar(100) default NULL,
			`secondary_address2` varchar(100) default NULL,
			`secondary_city` varchar(100) default NULL,
			`secondary_state` varchar(100) default NULL,
			`secondary_zip` int(10) default NULL,
			`secondary_phone` varchar(100) default NULL,
			`secondary_email` varchar(100) default NULL,
			PRIMARY KEY  (`order_id`)
			) TYPE=InnoDB;";
	} else if ($tblType == 'items') {
		$sql="CREATE TABLE $tblNameItems (
			`item_id` int(10) unsigned NOT NULL auto_increment,
			`quantity` int(10) unsigned NOT NULL,
			`price` int(10) unsigned NOT NULL,
			`product_id` int(10) unsigned NOT NULL,
			`product_name` varchar(255) NOT NULL,
			`product_info` text default NULL,
			`order_id` int(10) unsigned NOT NULL,
			PRIMARY KEY  (`item_id`)
			FOREIGN KEY (`order_id`) REFERENCES $tblNameOrders (`order_id`) on delete cascade
			) TYPE=InnoDB AUTO_INCREMENT=1;";
	} else {
		return false;
	}
	$query=$modx->db->query($sql);
	return $query;
}

$query=mysql_query("DESC $tblNameOrders");
if(!$query) {
	if(!createTable($tblNameOrders, $tblNameItems, 'orders')){
		return "Cannot create orders database";
	}
}
$query=mysql_query("DESC $tblNameItems");
if(!$query) {
	if(!createTable($tblNameOrders, $tblNameItems, 'items')){
		return "Cannot create order items database";
	}
}
?>

<?php
//escape values from post data
$order_id = $modx->db->escape($_POST['order_id']);
$date = $modx->db->escape($_POST['date']);
$firstname = $modx->db->escape($_POST['firstname']);
$lastname = $modx->db->escape($_POST['lastname']);
$address1 = $modx->db->escape($_POST['address1']);
$address2 = $modx->db->escape($_POST['address2']);
// etc.. all of the values that come from POST data must be escaped, very important!

$sql = "INSERT INTO $tblNameOrders (order_id, date, firstname, lastname, address1, address2, city, state, zip, phone, email, secondary_firstname, secondary_lastname, secondary_address1, secondary_address2, secondary_city, secondary_state, secondary_zip, secondary_phone, secondary_email) VALUES ($order_id, $date, $firstname, $lastname, $address1, $address2, $city, $state, $zip, $phone, $email, $secondary_firstname, $secondary_lastname, $secondary_address1, $secondary_address2, $secondary_city, $secondary_state, $secondary_zip, $secondary_phone, $secondary_email)";

$query=$modx->db->query($sql);
if (!$query) {
	return "Error in putting order to the database";
}
?>

<?php
//Again, escape the values from post data first, IMPORTANT!

$sql = "INSERT INTO $tblNameItems (quantity, price, product_id, product_name, product_info, order_id) VALUES ($quantity, $price, $product_id, $product_name, $product_info, $order_id)";

$query=$modx->db->query($sql);
if (!$query) {
	return "Error in putting order item(s) to the database";
}
?>

<?php
$order_id = $_POST['order_id'];
$sql = "DELETE FROM $tblNameOrders where order_id = $order_id";

$query=$modx->db->query($sql);
if (!$query) {
	return "Could not delete the order";
}
?>