SQLSTATE[HY000]：PHP 和 PDO 的一般错误
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/16674761/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
SQLSTATE[HY000]: General error with PHP and PDO
提问by Brandi Evans
I have a little login script.
我有一个小的登录脚本。
function login($sql) {
try {
$fbhost = "localhost";
$fbname = "foodbank";
$fbusername = "root";
$fbpassword = "";
$DBH = new PDO("mysql:host=$fbhost;dbname=$fbname",$fbusername,$fbpassword);
$DBH->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$STH = $DBH->query($sql);
$STH->setFetchMode(PDO::FETCH_ASSOC);
session_start();
if ($row = $STH->fetch()) {
$_SESSION['username'] = "$row[username]";
header("Location:index.php");
}
} catch(PDOException $e) {
echo $e->getMessage();
}
}
EDITS:
编辑：
index.php
索引.php
$sql = "SELECT username from users where username = ". $_POST['username'] ." AND password = ". $_POST['password'] ."";
login($sql);
Changed above from insert to select query. Now I get new error: SQLSTATE[42S22]: Column not found: 1054 Unknown column 'pvtpyro' in 'where clause'
上面从插入更改为选择查询。现在我收到新错误： SQLSTATE[42S22]: Column not found: 1054 Unknown column 'pvtpyro' in 'where clause'
回答by stef77
Based on your latest edit: You can't fetch results with PDO after executing an INSERT query. See here: http://www.php.net/manual/en/pdostatement.fetch.php#105682
根据您的最新编辑：执行 INSERT 查询后，您无法使用 PDO 获取结果。见这里：http: //www.php.net/manual/en/pdostatement.fetch.php#105682
Edit: I suppose, since the function's called "login", you want to have something like this as $sql: "SELECT password FROM users WHERE username = :username", and then iterate over the results with the while loop, and then log in the user if the password matches?
编辑：我想，因为函数被称为“登录”，你想要像 $sql: “SELECT password FROM users WHERE username = :username”这样的东西，然后用 while 循环迭代结果，然后登录在用户中，如果密码匹配？
Edit2: Based on your edit to provide a SELECT query: DO NOT USE THIS QUERY.What you are doing is NOT SQL injection proof. Never ever use variables from user input (i.e. $_POST, $_GET et al) and put them unfiltered into an SQL query. Please look up the term "prepared statements" here at SO or Google. As you can see, since you forgot to put single ticks (apostrophes) before and after the double quotes, MySQL thinks that your input refers to another column ("pvtpyro") instead of comparing the value in the column against a string. ALWAYS use the ":username", ":password" syntax (the one with prepended colons) or your queries will be unsafe and enormously dangerous to your application.
Edit2：根据您的编辑提供 SELECT 查询：请勿使用此查询。您正在做的不是 SQL 注入证明。永远不要使用来自用户输入的变量（即 $_POST、$_GET 等）并将它们未经过滤地放入 SQL 查询中。请在 SO 或 Google 上查找术语“准备好的声明”。如您所见，由于您忘记在双引号前后放置单个刻度（撇号），MySQL 认为您的输入引用了另一列（“pvtpyro”），而不是将列中的值与字符串进行比较。始终使用 ":username", ":password" 语法（带有冒号的语法），否则您的查询将不安全并且对您的应用程序非常危险。
回答by Doron
The constructor of PDO uses 2 variables which are not defined in the code you supplied - $fbhost and $fbname.
PDO 的构造函数使用了您提供的代码中未定义的 2 个变量 - $fbhost 和 $fbname。
EDIT:
You're calling session_start()inside the whileloop, which can cause errors. Take it out of the loop.
编辑：
您在循环session_start()内部调用while，这可能会导致错误。把它从循环中取出来。
EDIT 2:
You should really debug the code. Either via putting diein different parts of the code, outputting some helpful information just before (which is the less preferred way) OR by using xdebug and an IDE, which will allow you to run line by line, and see the exact state of each variable and such.
编辑 2：
您应该真正调试代码。通过放入die代码的不同部分，在之前输出一些有用的信息（这是不太受欢迎的方式），或者通过使用 xdebug 和 IDE，这将允许您逐行运行，并查看每个变量的确切状态诸如此类。
回答by samayo
If I undestand correctly, $data$STH->execute($data);should be an array, even if value is one. So, you may try replacing that query with $STH->execute(array($data));
如果我理解正确，$data$STH->execute($data);应该是一个数组，即使值是一。所以，你可以尝试用$STH->execute(array($data));
edited:
编辑：
Change your lines to this:
将您的线路更改为：
$data = array($_POST["username"], $_POST["password"]);
$sql = "INSERT INTO users (username, password) value (?, ?)";
$STH = $DBH->prepare($sql);
$STH->execute($data);
回答by user2406160
Seems to me that you're not connected to your database properly... I had this error earlier today and it was for that reason. Either that or you have an incorrect string
在我看来，你没有正确连接到你的数据库......今天早些时候我遇到了这个错误，正是因为这个原因。要么是你有一个不正确的字符串
