Never trust input. The num parameter must be validated to ensure it is a positive integer.
fetch('add-cart.php?id=5&num=2', headers: 'X-Requested-With': 'XMLHttpRequest' ) add-cart.php num
Instead of add-cart.php?num=123 , modern frameworks (like Laravel or Shopify) use clean URLs like POST /cart/add/123 . Never trust input