Are the prices taken from a field or a database?

Question

Information Security

I'm working on something right now. And there the price tag is taken from the get or post parameter and then payment is made. It also means that the user can enter any data in the browser and pay any amount. How do they generally act in such cases? They leave everything as it is, is it like the consumer is to blame for acting in bad faith? Or take price tags from the database?

Answer 1

All user input should always be checked, and of course prices are taken from the database.