Shopping cart login and coupon code validation
You need to learn how to use prepared statements, aka queries. That way, user input is never part of the SQL command.

https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

http://prash.me/php-pdo-and-prepared-statements/