数据库错误 HY000

Question

My code working fine , but i got this error :

SQLSTATE[HY000]: General error

I searching on google and someone say that it's may SQLi
What is this ? And how can i fix that ?
thanks and sorry for my poor english

    try{
        $db_con = new PDO("mysql:host={$db_host};dbname={$db_name}",$db_user,$db_pass);
        $db_con->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        // Anti Brute Forced
        $stmt = $db_con->prepare("
            SELECT * FROM users
        ");
        $stmt->execute();
        while ($row = $stmt->fetch(PDO::FETCH_ASSOC)){
            $users_username = $row["users_username"];
            $users_password = $row["users_password"];
            $users_wrong_password = $row["users_wrong_password"];
            if ($users_wrong_password <= 3 && isset($_GET["username"],$_GET["password"]) && $_GET["username"] == $users_username && $_GET["password"] != $users_password){
                $u = $users_wrong_password + 1;
                $g = 0;
                $g = $_GET['username'];
                $stmt = $db_con->prepare("
                    UPDATE users
                    SET users_wrong_password = $u
                    WHERE users.users_username = '$g'
                ");
                $stmt->execute();
            }
            if ($_GET["username"] == $users_username && $users_wrong_password >= 4){
                echo "Your Account Was Banned For 1 Hours";
                die;
            }
        }
        $g = $_GET['username'];
        $stmt = $db_con->prepare("SELECT * FROM users where users_username = '$g'");
        $stmt->execute();
        while ($row = $stmt->fetch(PDO::FETCH_ASSOC)){
            $ss = $row["users_wrong_password"];
        }
        if($ss <= 3){
            $g = 0;
            $g = $_GET['username'];
            $stmt = $db_con->prepare("
                UPDATE users
                SET users_wrong_password = 0
                WHERE users_username = '{$_GET['username']}'
            ");
            $stmt->execute();
        }
        // Anti Brute Forced

[Solved] Edit:

 $g = $_GET['username']; $p = $_GET['password']; $stmt = $db_con->prepare(" SELECT * FROM users where users_username = '$g' and users_password = '$p' ");

Answer 1

I think there are multiple preparations of the same query. Solution Get the query preparation out of the while.

code:

//... your code 
$stmt1 = $db_con->prepare("
         UPDATE users
         SET users_wrong_password = $u
         WHERE users.users_username = '$g'
");

$stmt->execute();
while ($row = $stmt->fetch(PDO::FETCH_ASSOC)){
     $users_username = $row["users_username"];
     $users_password = $row["users_password"];
     $users_wrong_password = $row["users_wrong_password"];
     if ($users_wrong_password <= 3 && isset($_GET["username"],$_GET["password"]) && $_GET["username"] == $users_username && $_GET["password"] != $users_password){
                        $u = $users_wrong_password + 1;
                        $g = 0;
                        $g = $_GET['username'];
    $stmt1->execute();
    //...
}

Answer 2

I found this problem in a similar another way

"errorInfo":["HY000"]

How does "HY000" error happen?

It happens when you are updating , deleting or inserting data with PDO, and you try to fetch it's result .

The solution, just do not use fetch or fetchAll methods after executing an updating, deleting or inserting . Surely, it does not make sense to fetch it's result!

Example:

        $stmt = $db_con->prepare("
            UPDATE users SET name = 'Renato' WHERE ID = 0
        ");
        $stmt->execute();
        $stmt->fetch(PDO::FETCH_ASSOC); // The mistake is here, just remove this line
        $stmt->fetchAll(PDO::FETCH_ASSOC); // It will cause troubles too, remove it

Solving the problem in a loop

The solution is changing the statement variable name inside loop , or fetch all before starting loop :

Solution: Changing variable name

        $stmt = $db_con->prepare("
            SELECT * FROM users
        ");
        $stmt->execute();

        while ($row = $stmt->fetch(PDO::FETCH_ASSOC)){
                // ...
                // This is another statment
                $another_stmt = $db_con->prepare("
                    UPDATE users
                    SET users_wrong_password = $u
                    WHERE users.users_username = '$g'
                ");
                $another_stmt->execute();
        }

Solution: Fetch all data from query before loop

        $stmt = $db_con->prepare("
            SELECT * FROM users
        ");
        $stmt->execute();
        
        // Everything is fetched here
        $results = $stmt->fetchAll(PDO::FETCH_ASSOC)
        foreach($results as $row){ // Another way to loop through results
                $stmt = $db_con->prepare("
                    UPDATE users
                    SET users_wrong_password = $u
                    WHERE users.users_username = '$g'
                ");
                $stmt->execute(); // Be happy with no troubles
        }

Answer 3

In order to help advance the horizon of human understand, and because Stackoverflow is a combination of Reddit and Wikipedia , i add the following information to help others.

These error codes are defined by the SQL standard itself, and are not specific to mysql, Postgres, or any other database. The HY000 SQLSTATE error code is part of the HYxxx series of error codes - which are for client errors (caller):

| SQLSTATE Class | Meaning
|----------------|--------------------------------------------------|
| 00xxx          | Unqualified Successful Completion                |
| 01xxx          | Warning                                          |
| 02xxx          | No Data                                          |
| 07xxx          | Dynamic SQL Error                                |
| 08xxx          | Connection Exception                             |
| 09xxx          | Triggered Action Exception                       |
| 0Axxx          | Feature Not Supported                            |
| 0Fxxx          | Invalid Token                                    |
| 0Kxxx          | Resignal When Handler Not Active                 |
| 0Nxxx          | SQL/XML Mapping Error                            |
| 10xxx          | XQuery Error                                     |
| 20xxx          | Case Not Found for Case Statement                |
| 21xxx          | Cardinality Violation                            |
| 22xxx          | Data Exception                                   |
| 23xxx          | Constraint Violation                             |
| 24xxx          | Invalid Cursor State                             |
| 25xxx          | Invalid Transaction State                        |
| 26xxx          | Invalid SQL Statement Identifier                 |
| 2Dxxx          | Invalid Transaction Termination                  |
| 34xxx          | Invalid Cursor Name                              |
| 35xxx          | Invalid Condition Number                         |
| 36xxx          | Cursor Sensitivity Exception                     |
| 38xxx          | External Function Exception                      |
| 39xxx          | External Function Call Exception                 |
| 3Bxxx          | Savepoint Exception                              |
| 3Cxxx          | Ambiguous Cursor Name                            |
| 40xxx          | Transaction Rollback                             |
| 42xxx          | Syntax Error or Access Rule Violation            |
| 44xxx          | WITH CHECK OPTION Violation                      |
| 46xxx          | Java™ Errors                                     |
| 51xxx          | Invalid Application State                        |
| 53xxx          | Invalid Operand or Inconsistent Specification    |
| 54xxx          | SQL or Product Limit Exceeded                    |
| 55xxx          | Object Not in Prerequisite State                 |
| 56xxx          | Miscellaneous SQL or Product Error               |
| 57xxx          | Resource Not Available or Operator Intervention  |
| 58xxx          | System Error                                     |
| 5Uxxx          | Common Utilities and Tools                       |
| HWxxx          | Datalink Exception                               |
| HVxxx          | FDW-specific condition                           |
| HYxxx          | CLI-specific condition                           |

In this case, the HY000 error is a generic error:

| SQLSTATE | Description
|----------|------------------------------------------------------------|
| HY000    | general error                                              |
| HY001    | memory allocation error                                    |
| HY003    | invalid data type in application descriptor                |
| HY004    | invalid data type                                          |
| HY007    | associated statement is not prepared                       |
| HY008    | operation canceled                                         |
| HY009    | invalid use of null pointer                                |
| HY010    | function sequence error                                    |
| HY011    | attribute cannot be set now                                |
| HY012    | invalid transaction operation code                         |
| HY013    | memory management error                                    |
| HY014    | limit on number of handles exceeded                        |
| HY017    | invalid use of automatically allocated descriptor handle   |
| HY018    | server declined the cancellation request                   |
| HY019    | non-string data cannot be sent in pieces                   |
| HY020    | attempt to concatenate a null value                        |
| HY021    | inconsistent descriptor information                        |
| HY024    | invalid attribute value                                    |
| HY055    | non-string data cannot be used with string routine         |
| HY090    | invalid string length or buffer length                     |
| HY091    | invalid descriptor field identifier                        |
| HY092    | invalid attribute identifier                               |
| HY093    | invalid datalink value                                     |
| HY095    | invalid FunctionId specified                               |
| HY096    | invalid information type                                   |
| HY097    | column type out of range                                   |
| HY098    | scope out of range                                         |
| HY099    | nullable type out of range                                 |
| HY103    | invalid retrieval code                                     |
| HY104    | invalid LengthPrecision value                              |
| HY105    | invalid parameter mode                                     |
| HY106    | invalid fetch orientation                                  |
| HY107    | row value out of range                                     |
| HY108    | invalid cursor position                                    |
| HYC00    | optional feature not implemented                           |

So in the same way:

• HTTP status: 400 Bad Request is a generic error
• SQLSTATE: HY000 is a generic error

Most databases will also provide a more vendor-specific error code or error messages.

In case anyone thought the HY000 code would be useful by itself for anything.