Prepared statement inside function that then return results
To begin, your indentation is a little off at places, such as in the while loop in the second code block, or the return statement in the first.



It looks like you keep o.checkout as an integers like the = '0' suggests, but use strings, as the '' suggests. If you do measure solely in integers, you ought to change the database type.




WHERE 
    o.username ='$user'



You should use bind_param() instead of straight injection, as it's safer for sanitisation.