Fatal error SQLSTATE[42000]

Question

Fatal error: Uncaught PDOException: SQLSTATE[42000]: 
 Syntax error or access violation: 1064 You have an error in your SQL syntax;
 check the manual that corresponds to your MySQL server version for the right
 syntax to use near 'WHERE id_categoria = ? LIMIT ?, ?' at line 1 in
 /home2/odont919/app.odontobr.com/post.php:55 Stack trace: 
   #0 /home2/odont919/app.odontobr.com/post.php(55): PDO->prepare('SELECT * FROM p...') 
   #1 {main} thrown in /home2/odont919/app.odontobr.com/post.php on line 55

This error happened after changing the order SELECT * FROM post for SELECT * FROM post ORDER BY id DESC. Can someone please help me?

<?php
session_start();
require_once '_header.php';
require_once '_database.php';

if (!empty($_GET['act']) && $_GET['act'] == 'logout') {
    unset($_SESSION["id"]);
    header('location:index.php');
    exit();
}

$arr_cat[] = array();
$records = $conn->prepare('SELECT * FROM categoria order by nome');
if ($records->execute()) {
    $arr_cat = $records->fetchAll(PDO::FETCH_ASSOC);
}

$_POST['paginaAtual'] = !empty($_POST['paginaAtual']) ? trim($_POST['paginaAtual']) : 1;
$_POST['qtdeItensPagina'] = !empty($_POST['qtdeItensPagina'])  ? $_POST['qtdeItensPagina']  : 40;

// always initialize a variable before use!
$conditions = array();
$parameters = array();

// conditional statements
if (!empty($_POST['legenda']))
{
    // here we are using LIKE with wildcard search
    // use it ONLY if really need it
    $conditions[] = 'legenda LIKE ?';
    $parameters[] = '%'.$_POST['legenda']."%";
}else $_POST['legenda'] = '';

if (!empty($_POST['id_categoria']))
{
    // here we are using equality
    $conditions[] = 'id_categoria = ?';
    $parameters[] = $_POST['id_categoria'];
}else $_POST['id_categoria'] = 0;

// the main query
$sql = "SELECT * FROM post ORDER BY id DESC";

// a smart code to add all conditions, if any
if ($conditions)
{
    $sql .= " WHERE ".implode(" AND ", $conditions);
}

$parameters[] = ($_POST['paginaAtual'] - 1) * $_POST['qtdeItensPagina'];
$parameters[] = $_POST['qtdeItensPagina'];
$sql_post = $sql . " LIMIT ?, ?";

// the usual prepare/execute/fetch routine
$stmt = $conn->prepare($sql_post);
$stmt->execute($parameters);
$arr_post = $stmt->fetchAll(PDO::FETCH_ASSOC);

$stmt_qtde = $conn->prepare($sql);
$stmt_qtde->execute($parameters);
$vet = $stmt_qtde->fetch( PDO::FETCH_ASSOC );
$qtdeTotal = (int)$vet['qtde'];

?>
<main role="main">
  <section class="shadow-md p-3 bg-white rounded">
    <div class="container">
    <form method="post">
      <div class="form-row align-items-center">
      <div class="col-sm-12 col-md-8 ">
        <input type="text" name="legenda" value="<?=$_POST['legenda']?>" class="form-control" placeholder="Busque por um assunto ou hashtag...">
      </div>
      <div class="col-sm-12 col-md-3 ">
        <select class="custom-select" name="id_categoria">
          <option value="0">Todas categorias...</option>
          <?php foreach ($arr_cat as $row) {?>
              <option <?=$row['id'] == $_POST['id_categoria'] ? 'selected' : ''?> value="<?=$row['id'];?>"><?=$row['nome'];?></option>
          <?php }?>
        </select>
       </div>
        <button type="submit" class=" col-sm-12 col-md-1 btn btn-primary"><i class="fas fa-search"></i></button>
      </div>
      <input type="hidden" name="paginaAtual" value="<?=$_POST['paginaAtual']?>" />
      </form>
  </section>

  <div class="album py-5">
    <div class="container">

        <?php if (count($arr_post) > 0) { ?>
            <div class="row">
                <?php foreach ($arr_post as $row) {?>
                  <div class="col-sm-12 col-md-3">
                      <div class="card mb-4 shadow-sm">
                        <img class="card-img-top" src="<?=$file_path . $row['nome_file']?>">

                        <div class="card-body">
                          <div class="card-title"><h6><?=$row['nome']?></h6></div>

                          <div class="d-flex justify-content-between align-items-center">
                            <div class="btn-group">
                                <?php if(!$limite_alcancado){?>
                                    <a data-toggle="tooltip" title="Ao pressionar download, será copiado a legenda para área de transferência" data-text="<?=$row['legenda']?>" target="_blank" href="_download.php?q=<?=base64_encode($row['id'].$separador.$row['nome'])?>" class="btn btn-sm btn-outline-primary btn_legend"><i class="fas fa-download"></i> Download</a>
                                    <a href="detalhe.php?q=<?=base64_encode($row['id'].$separador.$row['nome'])?>" class="btn btn-sm btn-outline-secondary"><i class="fas fa-info-circle"></i> Visualizar Legenda</a>
                                <?php }else{?>
                                    <a target="_blank" href="https://www.odontobr.com" class="btn btn-sm btn-success"><i class="fas fa-up"></i> Limite alcançado - realizar upgrade?</a>
                                <?php }?>
                            </div>
                            <!-- <small class="text-muted">9 mins</small> -->
                          </div>
                        </div>
                      </div>
                    </div>
                <?php } //foreach?>
            </div>
            <div class="row shadow-md p-3 bg-white rounded">
                <div class="col-sm-12 col-md-6">
                    <div id="paginacao"></div>
                </div>
            </div>      
        <?php
        } else { //if
            echo '<div class="alert alert-warning">Nenhuma imagem encontrada</div>';
        }
        ?>
    </div>
  </div>
</main>

<footer class="text-muted">
  <div class="container">
    <p class="float-right">
      <a href="#navbarHeader">Voltar ao início</a>
    </p>
    <p>Odontopubli - Copyright © 2019</p>

  </div>
</footer>

<script type="text/javascript">
    const totalItens = <?=$qtdeTotal?>;
    const itensPorPagina = <?=$_POST['qtdeItensPagina']?>;
</script>

<script src="js/jquery-3.3.1.slim.min.js"></script>
<script src="js/popper.min.js"></script>
<script src="js/bootstrap.min.js"></script>
<script src="js/pagination.min.js"></script>
<script src="js/post.js"></script>
  </body>
</html>

Answer 1

The problem is that the ORDER BY should come after the WHERE in a command sql.

Look at this piece of your code:

$sql = "SELECT * FROM post ORDER BY id DESC";

// a smart code to add all conditions, if any
if ($conditions)
{
    $sql .= " WHERE ".implode(" AND ", $conditions);
}

When you go through if, the command is already with the ORDER BY, and will add the WHERE after him, which will go wrong.

Change the code to only add the ORDER BY after the WHERE. You can for example remove all ORDER BY and add here:

$sql_post = $sql . " ORDER BY id DESC LIMIT ?, ?";

Here the command documentation select for better: SELECT