Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:105895
MIME-Version: 1.0
References: <dabdf489-0d4a-5be9-8858-83448dfd5d9a@lsces.uk>
 <CAF+90c81XGOeWex+nxTT+qyprUocsJ0QbnhAcF7qMxQc0TUUSg@mail.gmail.com>
 <b33877b2-0dce-c06f-f3ea-9f33746879a2@heigl.org> <f32890f7-710a-0476-de04-399516a274fa@lsces.uk>
In-Reply-To: <f32890f7-710a-0476-de04-399516a274fa@lsces.uk>
Date: Thu, 13 Jun 2019 15:04:49 +0300
Message-ID: <CAPhkiZxupMS6W4U_+zzjWoxBXTFcf5YxGAVWy0eO-z3sLNuj5w@mail.gmail.com>
To: Lester Caine <lester@lsces.uk>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [PHP-DEV] The real world ...
From: narf@devilix.net (Andrey Andreev)

Hi,

I too am in favor of a mechanism to strip out sensitive data from
error messages. But Lester, man, you have it all backwards ...

On Thu, Jun 13, 2019 at 11:37 AM Lester Caine <lester@lsces.uk> wrote:
>
> On 13/06/2019 08:55, Andreas Heigl wrote:
> >> display_errors=Off in production.
>
> Which give a white screen ... fine for security but useless for people
> using the site!
>

People using the site are not there to debug it. Whether they see a
white screen or an unhandled error that was never meant for them to
see, it's still bad user experience and of no use to anybody.

> Personally I STILL use display_errors=on and just make sure that
> sensitive information is not displayed in the stack. Most of the time it
> IS just the warnings one gets and clients can report them and see they
> are cleared ... so some sort of middle ground between off and on would
> be helpful?
>

You have logs to see the errors; relying on your users to report the
actual error messages to you is the worst way to do it.

Cheers,
Andrey.