Re: 2D array by POST

=?UTF-8?Q?Arne_Vajh=c3=b8j?= <[email protected]> wrote:

> On 5/19/2023 5:58 PM, J.O. Aho wrote:
> > On 5/19/23 21:38, Liz Tuddenham wrote:
> >> J.O. Aho <[email protected]> wrote:
> >> [...]
> >>> Yeah, I tend to favor to take prices from the database each time, this
> >>> more to keep the prices up to date, as then if someone changes a price
> >>> on a product that price change will get trough at once on all orders
> >>> that are not finalized.
> >>
> >> Unfortunately that could lead to an illegal situation in the UK.  The
> >> price has to be the one the user agreed to at the instant of clicking
> >> the button.  If the database has been updated between there and the
> >> checkout, the original price must still be charged.  (An unlikely
> >> scenario, but one with potentially very damaging consequences.)
> > 
> > Sure you shouldn't change price when the end customer agrees on the cost
> > and is sent to the payment page, at this point you can't change the
> > price, but until the customer can at any point decide that the updated
> > price isn't what they are prepared to pay for the product and remove it
> > from the cart. Of course it's a good thing to notify if the price would
> > change, one site that does this is amazon.co.uk.
> 
> Different business rules require different supporting functionality:
> 
> use current price => nothing special needed
> 
> use price customer saw => get that and verify that it is correct (not
> tampered with)
> 
> remove item and inform user => need to detect situation
> 
> >> The agreed-to price is carried through the transaction by a cookie, the
> >> small risk of tampering (and the low value of the goods) make this an
> >> acceptable risk. 
>  >
> > I would fire anyone in my team if they would say it's an acceptable
> > risk, values of a product, no matter if it's small and insignificant,
> > shouldn't ever be end user adjustable and when it comes out that you can
> > adjust the price, then people will start doing that and it's kind of a
> > simple thing to do nowadays with all the browser extensions.
> 
> Yes.
> 
> If the rumor spread on the internet that there is a web site selling
> anything where customers can hack the price and get it for that price,
> then I suspect they will get tens of thousands of new "customers"
> very quickly.

We might notice, our sales are less than £150 per year.


-- 
~ Liz Tuddenham ~
(Remove the ".invalid"s and add ".co.uk" to reply)
www.poppyrecords.co.uk