// Vulnerable code
if (isset($_POST["addToProduct"])) {
    if (isset($_SESSION["uid"])) {
        $p_id = $_POST["proId"];  // Direct user input retrieval
        $user_id = $_SESSION["uid"];
        
        // Direct concatenation into SQL query without any filtering
        $sql = "SELECT * FROM cart WHERE p_id = '$p_id' AND user_id = '$user_id'";
        $run_query = mysqli_query($con, $sql);
        $count = mysqli_num_rows($run_query);
        // ... subsequent code
    }
}

$p_id = $_POST["proId"]; 

$sql = "SELECT * FROM cart WHERE p_id = '$p_id' AND user_id = '$user_id'";

$run_query = mysqli_query($con, $sql)
    or die(mysqli_error($con));  // ❌ Direct exposure of database errors