Error reporting and security

ddrfreek

So I've been doing a lot of work recently to get my site's PHP applications as secure as possible, and I remember reading a bit about displaying error reporting actually making a script more vulnerable by revealing some of the inner workings. I was wondering if anyone had any general tips when it comes to error reporting, maybe some do's and don'ts. Sorry if that's a bit too vague of a request, I just want to hear some thoughts. A lot of my applications deal with MySQL as well, if that helps give a bit of context.

NogDog

The simplest thing is to ensure that your production server has display_errors set to off in the PHP configuration. You can then still have the error_reporting level set to however much reporting you want then, but the error message will go to either the default error log file or the one you specify in the error_log setting.

ddrfreek

Sounds good, I have an error log set up now actually, although I fear it might get a bit cluttered for practical use, I suppose if I really need to do some debugging I could just turn display_errors back on temporarily.

As for failed MySQL queries, do you suggest any kind of die error (mysql_error)?

NogDog

I would reserve die() only for the development process when you want to use it more or less like a breakpoint to output debug data. But the final code probably should not have any, and rather should have more "graceful" ways of handling errors. For instance, if a query fails, it would probably be better to log the debug info and then output some user-friendly error message, e.g.:

$result = mysql_query($query);
if($result == false)
{
   error_log(mysql_error() . "\n$query");
   echo "<p class='error'>Some nice error message here reassuring the user that this bug will be fixed soon></p>\n";
   echo "</body></html>\n";
}

And of course you could modularize a lot of this into a user-defined function that you would call instead in such a situation.

ddrfreek

Sounds like a good solution, I'll definitely be using that. Thanks!

Weedpacket

ddrfreek wrote:
if I really need to do some debugging I could just turn display_errors back on temporarily.

Though usually you shouldn't need to be doing this on the live server unless it's to do with some unavoidable configuration difference between that one and the one you actually work on.