Stop using the mysql extension. Use [man]mysqli[/man] or [man]PDO[/man].
The same info can be found both at php.net and mysql.com
This extension is deprecated as of PHP 5.5.0, and is not recommended for writing new code as it will be removed in the future. Instead, either the mysqli or PDO_MySQL extension should be used. See also the MySQL API Overview for further help while choosing a MySQL API.
I would recommend using PDO because it supports named placeholders for prepared statements. You'd be adviced to use prepared statements when using external data with your queries. On top of that, prepared statements with named placeholders would do a lot for the readability of your queries.
Consider for example your product insert query, which at least I find a lot more readable this way.
# Where $db would be an instance of PDO
$stmt = $db->prepare("insert into products
(title,description,qty,price,taxes,invoice) values
(:title, :description, :quantity, :price, :taxes, :id)");
$stmt->execute([
'title' => $val['title'],
'description' => $val['description'],
'quantity' => $val['qty'],
'price' => $val['price'],
'taxes' => $val['taxes'],
'id' => $id
];
But first off, you would still have your entire posted form in the $SESSION['products'] array. Including $SESSION['products']['action'] which is one of 'add', 'delete', 'update'.
Apart from that, what does $_POST actually contain? Specifically, how do you transfer product information? And how do you add additional products to the form before it is being submitted?
