e-commerce do's and don'ts

123

I thinking of setting up an online shop to sell my products and i was wondering if any one as any advice on the dos and don'ts with regards to setting up an e-commerce site.

I am mainly looking for technical advice but i will also welcome anything that you might feel is relevant.

Thanks

MarkR

Do:

Remember that data can change- don't think you can normalise away copies of the product sku, name, price in the basket / order line table(s)
Use a structured way of accessing the database, not via ad-hoc escaped / quoted queries (prepared queries and/or a ORM are a good idea)
Remember that a basket is just an order which isn't completed yet
Consider using a templating system as necessary (test / evaluate first)
Consider the merchant's business process - what matters to THEM.

Don't

Even think about storing credit card numbers anywhere
Optimise excessively
Make things too general
Implement product variants until / unless you ABSOLUTELY MUST

I have developed a fairly extensive ecommerce platform used on numerous sites- it's working fairly well but has some design issues (of course). We use Smarty as our templating system and DB_DataObjects as our ORM (Which I severely recommend against). We use PEAR DB (Which I know is now deprecated) as our database access layer and use prepared queries in places we're not going via the ORM.

Having fewer tables is usually better- if two things are "sort of similar", it's possible they could be the same kind of entity.

Good luck

Mark

MarkR

Oh yes - don't think that using a database is absolutely necessary if it's a very customised shop which has product data that don't change very often - particularly if you ARE the merchant.

I developed a complete ecommerce shop that was entirely file-based - I stored the orders in text files and the product data in PHP predefined arrays.

Mark

sneakyimp

i would like to add a don't
DON'T use paypal's api if you can help it - the support and docs are AWFUL.

Piranha

This is actually for all programming, but I think it is worth to think of:

DO:
- Check everything you recieve from the client every time you recieve it.
- Make sure that you are safe from SQL Injection for every variable in every query you do.
- Design the database, the pages and the code first and then start to program. It will save you from coding it 3-4 times, that is usually the case without designing first.
- Make sure to validate new accounts. Otherwise people will spam with new accounts.

DON'T:
- Think that people won't try to send fake GET and POST variables.
- Trust JavaScript to check the users input. It can easily be bypassed.

123

Hi Thanks for the replies any opinions on using automated tools to design an e-commerce site.

And i was seriously considering using pay pal any one else think its a bad idea

Elizabeth

Yet again I'd like to recommend using ZenCart - many functions and features are already built in and they have an awesome dev team that is very helpful. We've been using it since 2003 and had only minor issues really. I looked at many commercial carts ranging from $500 to $3000 and none of them had everything we were looking for. Zen Cart was the closest and with the source being open you can always hack it up to do what you need.

I also taught a class on e-commerce so if you have any specific questions I'd be happy to help. Otherwise I could go on about it for days and I'm sure nobody here wants that. 🙂

jazz_snob

Mark and Pirana really hit the nail on the head. Being too general ends up being a pain in the butt usually for the store owner, which is why I disdain OSC or zencart, xcart, etc. and only write custom sites for clients. For my own sites my template system is "includes" and my db access is thru my own DB wrapper class.

Note: if you need to track product inventory (ie how many widgets are in stock) then FORGET about using mysql < 5.x or whenever they get that fixed. Alternative: postgresql? Basically mysql 4.x is not obeying the constraints with which you actually define the columns by (eg: unsigned, not null, etc) and will happily enter a 0 or '' when really it should complain with an error.