My best guess would be something to the effect of :

?idProduct=1'+UNION+SELECT+(1,2)+FROM+users--
?idProduct=1"+UNION+SELECT+(1,2)+FROM+users--

Since it is choking on the union, my thought is it has to be something with the argument to idProduct and how the script is enclosing it in the subsequent SQL query...