PHP致命错误：消息为'SQLSTATE [42000]的未捕获异常'PDOException'：

Question

Sorry am getting this errors in my errors logs

PHP Fatal error:  Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1' in /home/payassur/public_html/admin/index.php:13
Stack trace:
#0 /home/payassur/public_html/admin/index.php(13): PDO->query('SELECT * FROM u...')
#1 {main}
  thrown in /home/payassur/public_html/admin/index.php on line 13

below is line 13

  $query = $db->query("SELECT * FROM users WHERE id = $u_id");

Answer 1

You're query is open to SQL injection , people have figured this out and thus are trying to inject the database. That is why you having those errors in your error log. You should start using prepared statements to prevent SQL injections

if (isset($u_id) && trim($u_id) != '') {
    $stmt = $db->prepare('SELECT * FROM users WHERE id = :u_id');
    $stmt->exectue(array('u_id' => $u_id,));
    $result = $stmt->fetchAll();
}else{
    $results = [];
}