title: php contains a form with insecure endpoint
body: <p>I am having an issue here, I'm working on my own website for university however I have came across a problem I can't find the answer to anywhere. I have a product page and a php module that handles adding the item to cart session data, however I'm getting this error: </p>
  
  <p><a href="https://saturn.csit.rmit.edu.au/~s3482230/wp/a2/product.php?productid=P001" rel="nofollow">https://saturn.csit.rmit.edu.au/~s3482230/wp/a2/product.php?productid=P001</a>' was loaded over a secure connection, but contains a form which targets an insecure endpoint 'module: add to cart.php'. This endpoint should be made available over a secure connection. (the website is hosted on the school servers that you cant access without login on so you can't view it sadly.</p>
  
  <p>but the form is writen as such...</p>
  
  <pre><code>&lt;form class=productqty action="module: add to cart.php" method="post"&gt;
      &lt;p id=price&gt;$&lt;span id=pricedouble&gt;0&lt;/span&gt;&lt;/p&gt;
      &lt;input name="price" id=prodprice type="hidden" value="20.00" required/&gt;
      &lt;input name="product code" type="hidden" value="P001" required/&gt;
      &lt;input name="quantity" id=qtyinput maxlength="3" type="text" value="1" 
      onblur='checkButtons()' onkeypress='checkIfNumber(event)' required/&gt;
      &lt;button id=negativebutton type="button" onclick="minusOne()" disabled&gt; - &lt;/button&gt;
      &lt;button id=positivebutton type="button" onclick="plusOne()"&gt; + &lt;/button&gt;
      &lt;input type="submit" value="Purchase" /&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>and the module code that handles adding to session and cart is: (unfinished)</p>
  
  <pre><code>&lt;?php
  session_start();
  
  if (isset($_SESSION['user'])) {
  
  }
  
  $_SESSION['cart'][$_POST['product code']]['qty'] = $_POST['quantity'];
  $_SESSION['cart'][$_POST['product code']]['price'] = $_POST['price'];
  
  
  header("Location: ".$_SESSION["redirect_url"]);
  ?&gt;
  </code></pre>
  
  <p>NOTE: the redirect_url is being used to redirect after logging on and off and works on those modules so it should work here, have also tried commenting the redirect out but doesn't change the warning, I hope this is enough information.</p>