Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:105891
MIME-Version: 1.0
References: <dabdf489-0d4a-5be9-8858-83448dfd5d9a@lsces.uk>
 <CAF+90c81XGOeWex+nxTT+qyprUocsJ0QbnhAcF7qMxQc0TUUSg@mail.gmail.com>
 <b33877b2-0dce-c06f-f3ea-9f33746879a2@heigl.org> <f32890f7-710a-0476-de04-399516a274fa@lsces.uk>
In-Reply-To: <f32890f7-710a-0476-de04-399516a274fa@lsces.uk>
Date: Thu, 13 Jun 2019 12:47:18 +0200
Message-ID: <CADyq6sJqvc52GqAJs0WSPKrsPbj9oUvBd9WfLWAf8V8cTo4JaQ@mail.gmail.com>
To: Lester Caine <lester@lsces.uk>
Cc: PHP Internals List <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000b3ffbd058b32414d"
Subject: Re: [PHP-DEV] The real world ...
From: ocramius@gmail.com (Marco Pivetta)

--000000000000b3ffbd058b32414d
Content-Type: text/plain; charset="UTF-8"

On Thu, Jun 13, 2019, 10:36 Lester Caine <lester@lsces.uk> wrote:

> On 13/06/2019 08:55, Andreas Heigl wrote:
> >> display_errors=Off in production.
>
> Which give a white screen ... fine for security but useless for people
> using the site!
>

Error logging is how this is to be approached.

Personally I STILL use display_errors=on and just make sure that
> sensitive information is not displayed in the stack. Most of the time it
> IS just the warnings one gets and clients can report them and see they
> are cleared ... so some sort of middle ground between off and on would
> be helpful?
>

Logging, logging, logging.

Displaying traces just gives malicious third parties a tasty data
exfiltration endpoint.

--000000000000b3ffbd058b32414d--