When removing an item from the cart, why do you suppose that the query validates the session ID of the user against the record?
What would be a reason not to store the price in a hidden field when adding to the cart?
