products.php

<?php
error_reporting(E_ALL & ~E_DEPRECATED);  // ~E_DEPRECATED because mysql extension is deprecated since PHP 5.5
include '../config/config.php';
if ($pdo) {
	// Use PDO
	$database = new PDO("mysql:host=$dbHost;dbname=$dbSchema", $dbUsername, $dbPassword);
	if (isset($_GET['id'])) {
		$statement = $database->prepare('SELECT id, name, description, image FROM products WHERE id = ?');
		$statement->execute(array($_GET['id']));
	} else {
		$statement = $database->query('SELECT id, name, description, image FROM products ORDER BY name');
	}
	$rows = $statement->fetchAll(PDO::FETCH_ASSOC);
} else {
	// If you can't use PDO
	mysql_connect($dbHost, $dbUsername, $dbPassword);
	mysql_select_db($dbSchema);
	mysql_set_charset('utf8');
	if (isset($_GET['id'])) {
		$id = $_GET['id'];  // WRONG, vulnerable to SQL Injection attack
		$id = mysql_real_escape_string($_GET['id']);  // WRONG, still vulnerable to SQL Injection attack
		// $id = (int)$_GET['id'];  // CORRECT, SQL query expects a number not a string, that's why escaping is not enough
		$sql = "SELECT id, name, description, image FROM products WHERE id = $id";
	} else {
		$sql = "SELECT id, name, description, image FROM products ORDER BY name";
	}
	$result = mysql_query($sql);
	$rows = array();
	while ($row = mysql_fetch_assoc($result)) {
		$rows[] = $row;
	}
}

echo '<ul>';
foreach ($rows as $row) {
	printf('<li><a href="?id=%s">%s</a>(%s)</li>',
		htmlspecialchars($row['id']),
		htmlspecialchars($row['name']),
		htmlspecialchars($row['description'])
	);
}
echo '<ul>';