I'm testing stripe API and I'm wondering how to avoid that user changes prices by HTML and/or javascript code?
As you can see in my code, anybody with a bit of coding knowledge could change price value in the input #price, input checkboxes, or even directly change it in console with $("#price").val(some_value);
HTML SAMPLE CODE
<form id="articles_form">
<div>
<div>
<label for="one_article">One Article</label>
<input class="articles" type="checkbox" name="one_article" id="one_article" value="90">
</div>
<div>
<label for="another_article">Another Article</label>
<input class="articles" type="checkbox" name="another_article" id="another_article" value="75">
</div>
</form>
<form action="payment_form.php" method="post" id="payment-form">
<div class="form-row">
<input type="hidden" name="user_id" value="<?php echo $user_id; ?>" />
<input type="hidden" name="price" id="price" value="">
<input type="hidden" name="products" id="products">
<input type="text" name="first_name" class="form-control StripeElement StripeElemet--empty" placeholder="Name">
<input type="text" name="last_name" class="form-control StripeElement StripeElemet--empty" placeholder="Surname">
<input type="email" name="email" class="form-control StripeElement StripeElemet--empty" placeholder="Email">
</div>
</form>
JS SAMPLE CODE
<script>
$(".articles").each(function(){
$(this).on("change", function(){
let value = 0;
let products = '';
$(".articulos").each(function(){
if(this.checked == true){
value = parseInt($(this).val()) + value;
products = $(this).attr("id") + '|' + products;
}
})
$("#price").val(value);
$("#btn-pagar").text('payment ' + value + '€');
$("#products").val(products);
})
})
</script>
How could avoid that?