Is this user input field secure?
You can secure against CSRF (pronounced C-surf) by using ValidateAntiForgeryTokenAttribute and AntiForgeryToken method.

How CSRF (Cross Site Request Forgery) works:  


  We have 2 actors, an evil person E and a good person G.   E makes an
  evil html image tag on some forum, that links to your website and puts
  a product in your user's cart.
  
  If G has a cookie for your site and the cookie is not expired, when G
  goes to E's forum, the browser tries to load the html img and it will
  send a Request to your site. Even though G didn't intend to do that...


Implementation:

View:

@using (Html.BeginForm("AddToCart", "Cart"))
{
   @HtmlHelper.AntiForgeryToken()
   // Code --&gt;
}


Controller:

[HttpPost][ValidateAntiForgeryToken]
public ActionResult AddToCart(int id, int quantity)
{
   // Code --&gt;
}


How it prevents CSRF:


In the view a hidden input field with a unique string is created.
A cookie is sendt to the user with the same string. (I believe it is a httpOnly cookie).
The controller checks if the form contains the same string as is in the cookie.


Because person E, cannot form a valid form post the cross site request will fail. But note that if you have XSS (Cross site scripting) vulnerability this security check can be circumvented.

And another thing... If your 2nd method public void AddToCart(Product product, int quantity) is not an action consider using the [NonAction] attribute, because all public methods in a controller are considered by default Action methods. Meaning it is invokable as an Action method.