数据库错误HY000

Question

我的代码工作正常，但我收到了这个错误：

  

SQLSTATE [HY000]：常规错误

我在谷歌搜索，有人说这可能是SQLi
这是什么 ？我该如何解决这个问题？
谢谢，抱歉我的英文不好

    try{
        $db_con = new PDO("mysql:host={$db_host};dbname={$db_name}",$db_user,$db_pass);
        $db_con->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        // Anti Brute Forced
        $stmt = $db_con->prepare("
            SELECT * FROM users
        ");
        $stmt->execute();
        while ($row = $stmt->fetch(PDO::FETCH_ASSOC)){
            $users_username = $row["users_username"];
            $users_password = $row["users_password"];
            $users_wrong_password = $row["users_wrong_password"];
            if ($users_wrong_password <= 3 && isset($_GET["username"],$_GET["password"]) && $_GET["username"] == $users_username && $_GET["password"] != $users_password){
                $u = $users_wrong_password + 1;
                $g = 0;
                $g = $_GET['username'];
                $stmt = $db_con->prepare("
                    UPDATE users
                    SET users_wrong_password = $u
                    WHERE users.users_username = '$g'
                ");
                $stmt->execute();
            }
            if ($_GET["username"] == $users_username && $users_wrong_password >= 4){
                echo "Your Account Was Banned For 1 Hours";
                die;
            }
        }
        $g = $_GET['username'];
        $stmt = $db_con->prepare("SELECT * FROM users where users_username = '$g'");
        $stmt->execute();
        while ($row = $stmt->fetch(PDO::FETCH_ASSOC)){
            $ss = $row["users_wrong_password"];
        }
        if($ss <= 3){
            $g = 0;
            $g = $_GET['username'];
            $stmt = $db_con->prepare("
                UPDATE users
                SET users_wrong_password = 0
                WHERE users_username = '{$_GET['username']}'
            ");
            $stmt->execute();
        }
        // Anti Brute Forced

[解决] 编辑：

		$g = $_GET['username'];
		$p = $_GET['password'];
		$stmt = $db_con->prepare("
			SELECT * FROM users where users_username = '$g' and users_password = '$p'
		");

Answer 1

我以另一种类似的方式发现了这个问题

<块引用>

"errorInfo":["HY000"]

“HY000”错误是如何发生的？

当您更新、删除或插入时会发生这种情况> 带有 PDO 的数据，然后您尝试获取它的结果。

解决方案，在执行更新、删除或插入后不要使用 fetch 或 fetchAll 方法。当然，获取它的结果是没有意义的！

示例：

        $stmt = $db_con->prepare("
            UPDATE users SET name = 'Renato' WHERE ID = 0
        ");
        $stmt->execute();
        $stmt->fetch(PDO::FETCH_ASSOC); // The mistake is here, just remove this line
        $stmt->fetchAll(PDO::FETCH_ASSOC); // It will cause troubles too, remove it

循环解决问题

解决方案是改变循环内的语句变量名，或者在开始循环之前获取所有：

解决方案：更改变量名称

        $stmt = $db_con->prepare("
            SELECT * FROM users
        ");
        $stmt->execute();

        while ($row = $stmt->fetch(PDO::FETCH_ASSOC)){
                // ...
                // This is another statment
                $another_stmt = $db_con->prepare("
                    UPDATE users
                    SET users_wrong_password = $u
                    WHERE users.users_username = '$g'
                ");
                $another_stmt->execute();
        }

解决方案：在循环之前从查询中获取所有数据

        $stmt = $db_con->prepare("
            SELECT * FROM users
        ");
        $stmt->execute();
        
        // Everything is fetched here
        $results = $stmt->fetchAll(PDO::FETCH_ASSOC)
        foreach($results as $row){ // Another way to loop through results
                $stmt = $db_con->prepare("
                    UPDATE users
                    SET users_wrong_password = $u
                    WHERE users.users_username = '$g'
                ");
                $stmt->execute(); // Be happy with no troubles
        }

Answer 2

我认为同一查询有多个准备工作。 解决方案暂时获取查询准备。

代码：

//... your code 
$stmt1 = $db_con->prepare("
         UPDATE users
         SET users_wrong_password = $u
         WHERE users.users_username = '$g'
");

$stmt->execute();
while ($row = $stmt->fetch(PDO::FETCH_ASSOC)){
     $users_username = $row["users_username"];
     $users_password = $row["users_password"];
     $users_wrong_password = $row["users_wrong_password"];
     if ($users_wrong_password <= 3 && isset($_GET["username"],$_GET["password"]) && $_GET["username"] == $users_username && $_GET["password"] != $users_password){
                        $u = $users_wrong_password + 1;
                        $g = 0;
                        $g = $_GET['username'];
    $stmt1->execute();
    //...
}