Don't confuse URLs with filepaths, as the two are not the same thing. In fact, the primary job of a server is to translate a URL request into a file request that is compatible with the operating system of the machine on which the server runs.
It is possible that there is some code in the server configuration that is mapping the file product1.php onto multiple URLs, and that is why your sitemap generator finds multiple URLs.
The real question is, if you click on one of those "product" links, does it work?
If you have a link on a page, and it refers to another page at the same URL "directory" level, then using href="otherpage.php" is fine. If the other page is in the "directory" above the one that is linking, then you'd use href="../otherpage.php", and if below, then href="/child-directory/otherpage.php".
You can also use server-root-relative links by specifying a leading slash to point to the Web root "directory" and then work down from there: href="/parent/child/child/otherpage.php". Finally, you can also use the canonical URL as you stated in your post.
This is all general info; It will take a much more-detailed description of your server type, server configuration, "shopping cart" and server software, and development environment in order to diagnose this problem.