Error Call to a member function fetchAll() on boolean

Question

Hello can you help me with these error i get them idk how i just entered the site and i got this errors.

Fatal error: Call to a member function rowCount() on boolean in C:\xampp\htdocs\settings.php on line 6

if (isset($_COOKIE['hash'])) { 
    $sql = $db->query("SELECT * FROM `users` WHERE `hash` = " . $db->quote(filter_var($_COOKIE['hash'], FILTER_SANITIZE_STRING)));
    if ($sql->rowCount() != 0) { //line 6
        $row = $sql->fetch();
        $user = $row;
    }
}

Fatal error: Call to a member function fetchAll() on boolean in C:\xampp\htdocs\login.php on line 42

        $hash = md5($steamid . time() . rand(1, 50)); 
        $sql = $db->query("SELECT * FROM `users` WHERE `steamid` = '" . $steamid . "'");
        $row = $sql->fetchAll(PDO::FETCH_ASSOC); //line 42
        if (count($row) == 0) {

            $name = str_replace("script", "*", $name);
            $name = str_replace("/", "*", $name);
            $name = str_replace("<", "*", $name);
            $name = str_replace(">", "*", $name);
            $name = str_replace("body", "*", $name);
            $name = str_replace("onload", "*", $name);
            $name = str_replace("alert", "*", $name);
            $name = str_replace(")", "*", $name);
            $name = str_replace("(", "*", $name);
            $name = str_replace("'", "*", $name);

md5 hashes are useless, they've been crackable for years. Use something stronger like a newer SHA algorithm. Also your code is potentially vulnerable to SQL injection attacks. You're using PDO so make use of its parameterisation features. — ADyson, Nov 17 '17 at 20:23
Anyway chances are the reason you can't call these functions is probably because your query failed somehow. http://php.net/manual/en/pdo.query.php says the method will return `false` on failure, instead of returning a PDOStatement object. Turn on error reporting and see what's going wrong. — ADyson, Nov 17 '17 at 20:25

score -2 · Answer 1 · answered Nov 17 '17 at 19:47

There's absolutely NO reason to assume your query will always execute successfully. Your sin is to have no error handling, which means lack of checking what query() returned. And by docs it returns:

PDO::query() returns a PDOStatement object, or FALSE on failure.

so, as you get boolean it clearly means it fails on your query.

Error Call to a member function fetchAll() on boolean

1 Answers1