mysql + php review

checkout.php

<?php
/**
+---------------+
| users         |
+---------------+
| id int, AI, PK|
| balance int   |
+---------------+

+---------------+
| items         |
+---------------+
| id int, AI, PK|
| cost int      |
+---------------+
*/
function checkoutAction($userId)
{
    $list = count($_POST['list']) > 0 ? $_POST['list'] : array();
    $user = mysql_fetch_assoc(mysql_query("SELECT `balance` FROM `users` WHERE `id` = $user_id"));
    foreach($list as $item){
        $row = mysql_fetch_assoc(mysql_query("SELECT cost FROM `items` WHERE `id`={$item['id']}"));
    	$user['balance'] -= $row['cost'];
        mysql_query("UPDATE `users` SET `balance` = {$user['balance']} WHERE `id`={$item['id']}");
    }
}