Script execution via unsanitized amount_1 echo

Cross-site scripting in checkout.php in Code Projects Online Shopping System 1.0 allows remote authenticated users to execute script via amount_1. In the checkout item loop, checkout.php reads the posted amount_1 value into $amount_ and echoes it inside a paragraph element with no output encoding or sanitization, so attacker-supplied markup is reflected into the response. Exploitation requires access to the checkout workflow and a victim who renders the returned page; the public PoC demonstrates JavaScript execution that can support session theft or phishing in that browser context.