PHP Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]:

Question

Sorry am getting this errors in my errors logs

PHP Fatal error:  Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1' in /home/payassur/public_html/admin/index.php:13
Stack trace:
#0 /home/payassur/public_html/admin/index.php(13): PDO->query('SELECT * FROM u...')
#1 {main}
  thrown in /home/payassur/public_html/admin/index.php on line 13

below is line 13

  $query = $db->query("SELECT * FROM users WHERE id = $u_id");

So `$u_id` has a value? How Looks your query if you echo it out? — Jens, Jun 08 '17 at 07:20
But the variable must have a value. if not your SQL can not work — Jens, Jun 08 '17 at 07:38
What would you achive with that query? valid SQL is for instance `SELECT * FROM users WHERE id = ` where value is a number, or `SELECT * FROM users WHERE id is null` if you are looking for rows which has no id — Jens, Jun 08 '17 at 07:57
PHP and SQL are different languages executed by different programs, some times even in different computers. MySQL cannot see your PHP code, all that matters is the SQL code you send. — Álvaro González, Jun 08 '17 at 08:14
@AbiodunVictor You should give us more context arround your Problem. please post a [mcve] — Jens, Jun 08 '17 at 09:34

DarkBee · Answer 1 · 2017-06-08T09:17:04.090

0

You're query is open to SQL injection, people have figured this out and thus are trying to inject the database. That is why you having those errors in your error log. You should start using prepared statements to prevent SQL injections

if (isset($u_id) && trim($u_id) != '') {
    $stmt = $db->prepare('SELECT * FROM users WHERE id = :u_id');
    $stmt->exectue(array('u_id' => $u_id,));
    $result = $stmt->fetchAll();
}else{
    $results = [];
}

edited Jun 08 '17 at 09:17

answered Jun 08 '17 at 09:05

DarkBee

13,798
5
41
53

That wan't help, if $_id is blank as in the case of OP – Jens Jun 08 '17 at 09:14
Why should it be blank? Someone could have changed a querystring to `www.example.com?u_id='`. OP is stating he/she finds this error in the error log, so sure it's not because OP is still testing his/her own code? – DarkBee Jun 08 '17 at 09:18
see the comment of op: *No, $u_id not have value* – Jens Jun 08 '17 at 09:19
Well OP said `$u_id` was holding an id, not a value, `$u_id not have value but id`, thats does not makes it empty – DarkBee Jun 08 '17 at 09:28

PHP Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]:

1 Answers1