Prepared statement WHERE clause to open a details page - where-clause

Question

In the main page I want the following link to open a details page:
<td><a href=details.php?c_id=<?php echo $c_id ?> ><img src="./images/<?php echo $row['cfilename']; ?>" width="90" height="120" alt="" /></a></td>
And the details.php code:
<?php
$mysqli = new mysqli("localhost", "joseph", " ", "collectionsdb");
/* check connection */
if (mysqli_connect_errno()) {
printf("Connect failed: %s\n", mysqli_connect_error());
exit();
}
// get value of object id that was sent from address bar
//$c_id = mysql_real_escape_string(c_id);
/* Create the prepared statement */
if ($stmt = $mysqli->prepare("SELECT c_id,ctitle,csubject,creference,cyear,cobjecttype,cmaterial,ctechnic,cwidth,cheight,cperiod,cmarkings,cdescription,csource,cartist,cfilename FROM collections WHERE c_id=$c_id")) {
/* Execute the prepared Statement */
$stmt->execute();
/* Bind results to variables */
$stmt->bind_result($c_id,$ctitle,$csubject,$creference,$cyear,$cobjecttype,$cmaterial,$ctechnic,$cwidth,$cheight,$cperiod,$cmarkings,$cdescription,$csource,$cartist,$cfilename);
/* fetch values */
while ($rows = $stmt->fetch()) {
// display records in a table
// and the table of results
?>
However, when i press the link the details.php opens with all the data. I expect to only open data of a particular $c_id variable. I am not sure why it is not being passed to the details page. In the way I have put the WHERE condition, I am geting an undefined variable error for c_id.
Please,what have I missed?
Joseph

Answer 1

First
$mysqli = new mysqli("localhost", "joseph", " ", "collectionsdb");
You are passing space to db password. Should be
$mysqli = new mysqli("localhost", "joseph", "", "collectionsdb");
Second
Is your global_register directive in php.ini enabled?
If enabled, the variable you have assigned as query string will be passed as $c_id. You can check if register_globals enabled by write php_info() in this page. See here
If not enabled, you need to assign query string variables value to a variable or directly pass the variable to the database.
Style 1:
$c_id = $_GET['c_id'];
$stmt = $mysqli->prepare("SELECT c_id,ctitle,csubject,creference,cyear,cobjecttype,cmaterial,ctechnic,cwidth,cheight,cperiod,cmarkings,cdescription,csource,cartist,cfilename FROM collections WHERE c_id=$c_id"
Style 2:
$stmt = $mysqli->prepare("SELECT c_id,ctitle,csubject,creference,cyear,cobjecttype,cmaterial,ctechnic,cwidth,cheight,cperiod,cmarkings,cdescription,csource,cartist,cfilename FROM collections WHERE c_id=$_GET['c_id']"
Sanitize you value from query string for style 1 & 2.. Hackable. :)
Let register_global directive enabled is not good. Advise, take the value from query string, sanitize it and pass to the query.