Like I said, you might want to read up on PHP.
First off, you have opened a string with " but you fail to close it.
Additionally, "session_id" is a string with exactly that phrase. I doubt you will ever have a cart id that is equal to the string of letters that spell out "session_id". You should do something like
$sql = "SELECT blah blah blah WHERE cartid=" . session_id();
each line must be terminated by a semicolon, etc. This is very basic stuff. Again, you can try www.php.net or perhaps this book . If you're desperate, you can have it delivered overnite.