PHP error guide

SQLSTATE 28000 access denied: meaning and fix

fatal sqlstate Affects: PDO with MySQL/MariaDB; exact server wording varies Last verified:

Error summary

Verify the account host part and rotate the application credential without logging it. MySQL rejects authentication for the presented account, host identity, or credential.

What it means

Verify the account host part and rotate the application credential without logging it. MySQL rejects authentication for the presented account, host identity, or credential.

What the error means

This message means that MySQL rejects authentication for the presented account, host identity, or credential. The exact signature distinguishes sqlstate 28000 access denied from a generic application failure.

Why PHP produces it

The engine or service reports “SQLSTATE 28000 access denied” because its required precondition was not met. Verify the account host part and rotate the application credential without logging it.

PHP version notes

The sqlstate 28000 access denied wording here is based on PDO with MySQL/MariaDB; exact server wording varies; punctuation and exception class names can differ on older branches or vendor builds.

Most common causes

  • The immediate input or configuration reaches the specific condition: MySQL rejects authentication for the presented account, host identity, or credential
  • The code path assumes the prerequisite for sqlstate 28000 access denied has already been satisfied.
  • For sqlstate 28000 access denied, development and production differ in version, extension, permissions, paths, or service configuration.
  • An earlier operation returned an unchecked value that is consumed by the line reporting sqlstate 28000 access denied.

Minimal examples

BAD — reproduces the problem

php 
$pdo = new PDO($dsn, "root", "wrong");

FIXED — safer pattern

php 
$pdo = new PDO($dsn, getenv("DB_USER"), getenv("DB_PASSWORD"));

Step-by-step diagnosis

  1. Copy the complete “SQLSTATE[28000] [1045] Access denied for user 'app'@'127.0.0.1' (using password: YES)” text and retain the first application stack frame.
  2. Reproduce sqlstate 28000 access denied in the same SAPI and environment listed for this page.
  3. Before changing sqlstate 28000 access denied, inspect the preceding value or directive and verify its type, path, version, and permissions.
  4. Apply the narrow correction—verify the account host part and rotate the application credential without logging it—then repeat the original request once.

Fixes

Correct the failing prerequisite

Verify the account host part and rotate the application credential without logging it

php 
$pdo = new PDO($dsn, getenv("DB_USER"), getenv("DB_PASSWORD"));

Fail explicitly at the boundary

Validate the condition before the operation that emits sqlstate 28000 access denied, and log a safe diagnostic without credentials or full production paths.

Common mistakes when fixing it

  • Suppressing sqlstate 28000 access denied instead of correcting its upstream condition.
  • Testing sqlstate 28000 access denied only with the CLI binary when the failing request runs under FPM or Apache.
  • Changing a global setting for sqlstate 28000 access denied before confirming the site-specific effective configuration.

How to prevent it

  • Add a focused test that exercises the boundary responsible for sqlstate 28000 access denied.
  • Keep runtime versions, extensions, configuration, and deploy artifacts affecting sqlstate 28000 access denied reproducible.
  • Validate external data and service return values before they can trigger sqlstate 28000 access denied.

Web server / environment notes

fpm, cli, docker, linux. The failure occurs where mySQL rejects authentication for the presented account, host identity, or credential

Tags: fpm,cli,docker,linux

Categories