Having troubles with viewing a product in PHP & SQL - php

Question

I wanted to make an automatic table display all the products from the database, where you can click on its name and view the whole details of the product. And my idea was that it wouldn't bring you to another .php file, but rather you'll still be on the same page so you wouldn't waste time on creating multiple .php files of every products.
The problem is, whenever I click on a product, it wouldn't load the product's information (the only detail is the description by the way).
Error
Fatal error: Cannot use object of type mysqli_result as array in C:\wamp\www\goldenrod\index.php on line 56
This is the database connection:
<?php
//Database Connections
$dbc = mysqli_connect('localhost', 'root', '', 'lionsierra_db') or die("Cannot find specified server");
//Product Database
$db_products = "SELECT * FROM `products`";
$products = mysqli_query($dbc, $db_products);
?>
And this is the function:
<?php
//View product
if(isset($_GET['view_product'])) {
while($product=mysqli_fetch_assoc($products)) {
$products['ID'] = $_GET['view_product'];
//Display a product
echo "<p><span>
<span style='font-weight:bold;'>" . $products['ID']['name'] . "</span><br/>
<span>$" . $products['ID']['price'] . "</span><br/>
<span>" . $products['ID']['category'] . "</span><br/>
<span>" . $products['ID']['description'] . "</span>
</p>";
}
}
//View all products
echo '<table width="600" border="1" cellpadding="1" cellspacing="1">
<tr>
<th>Name</th>
<th>Price</th>
<th>Category</th>
</tr>';
while($product=mysqli_fetch_assoc($products)) {
echo "<tr>
<td><a href='./index.php?view_product=" . $product['ID'] . "'>". $product['name'] . "</a></td>
<td>" . $product['price'] . "</td>
<td>" . $product['category'] . "</td>
</tr>";
$ID = $product['ID'];
}
?>
I'm still fairly new to PHP and SQL, and it would be grateful if you guys could help me out.

Answer 1

The issue resides here:
if(isset($_GET['view_product'])) {
while($product=mysqli_fetch_assoc($products)) {
Looks like you're just re-using a MySQLI query here. Instead, you should be altering the query depending on the productID. Let's see what that looks like:
if(isset($_GET['view_product'])) {
//now let's build out our query
$view_product_statement = mysqli_prepare($conn, "SELECT * FROM products WHERE ID = ?");
mysqli_stmt_bind_param($view_product_statement, 'i', $_GET['view_product']);
mysqli_stmt_execute($view_product_statement);
mysqli_stmt_bind_result($view_product_statement);
while($product=mysqli_fetch_assoc($view_product_statement)){
//now $product holds reference to the one we're trying to view.
}
mysqli_stmt_close($view_product_statement);
}
I've used prepared statements in my above to help sanitize your user input in such a way that you help avoid SQL Injection.