Shopping cart with Ajax
So far what I see is you aren't either casting nor sanitizing your $_POST variables but simply placing them into your SQL statement - it's better you perform some sort of filtering on those arguments (e.g. remove whitespaces, fixing invalid characters like '\' to '\\', etc.) and ensure you are passing numbers (according to your example you'd maybe use intval()), not a string or NULL value (unless that's intended, which I doubt).

In addition, the server-end should separate the database calls from parsing and filtering content - either as separate functions, files and/or both; if you were going the OOP route, then you'd set up a class(es) for either activity and use a layering system like MVC, N-Tier, MVVC.

All of this goes into making your code more reusable and easier to manage plus adds a layer of security via "Abstraction".