Re: 2D array by POST

On 5/19/2023 5:58 PM, J.O. Aho wrote:
> On 5/19/23 21:38, Liz Tuddenham wrote:
>> J.O. Aho <[email protected]> wrote:
>> [...]
>>> Yeah, I tend to favor to take prices from the database each time, this
>>> more to keep the prices up to date, as then if someone changes a price
>>> on a product that price change will get trough at once on all orders
>>> that are not finalized.
>>
>> Unfortunately that could lead to an illegal situation in the UK.  The
>> price has to be the one the user agreed to at the instant of clicking
>> the button.  If the database has been updated between there and the
>> checkout, the original price must still be charged.  (An unlikely
>> scenario, but one with potentially very damaging consequences.)
> 
> Sure you shouldn't change price when the end customer agrees on the cost 
> and is sent to the payment page, at this point you can't change the 
> price, but until the customer can at any point decide that the updated 
> price isn't what they are prepared to pay for the product and remove it 
> from the cart. Of course it's a good thing to notify if the price would 
> change, one site that does this is amazon.co.uk.

Different business rules require different supporting functionality:

use current price => nothing special needed

use price customer saw => get that and verify that it is correct (not 
tampered with)

remove item and inform user => need to detect situation

>> The agreed-to price is carried through the transaction by a cookie, the
>> small risk of tampering (and the low value of the goods) make this an
>> acceptable risk. 
 >
> I would fire anyone in my team if they would say it's an acceptable 
> risk, values of a product, no matter if it's small and insignificant, 
> shouldn't ever be end user adjustable and when it comes out that you can 
> adjust the price, then people will start doing that and it's kind of a 
> simple thing to do nowadays with all the browser extensions.

Yes.

If the rumor spread on the internet that there is a web site selling
anything where customers can hack the price and get it for that price,
then I suspect they will get tens of thousands of new "customers"
very quickly.

Arne