Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:127092
Precedence: bulk
MIME-Version: 1.0
References: <CAObMQFcUB48LEusdtYNS2hnr_qyKJppC11qfbGxkOkuKQtqmEg@mail.gmail.com>
 <2e02e8bd16ccd8f326a014fa3812da43@bastelstu.be>
In-Reply-To: <2e02e8bd16ccd8f326a014fa3812da43@bastelstu.be>
Date: Fri, 11 Apr 2025 09:10:11 +0800
Message-ID: <CAObMQFeJRhgeG_NBm-twGbDVi0Sfc5TMiSNM7bSMJFTfmO_Fjw@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] [Discussion] Change default for
 zend.exception_ignore_args INI setting
To: =?UTF-8?Q?Tim_D=C3=BCsterhus?= <tim@bastelstu.be>
Cc: internals@lists.php.net
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
From: andrew@nicols.co.uk (Andrew Lyons)

On Thu, 10 Apr 2025 at 23:20, Tim D=C3=BCsterhus <tim@bastelstu.be> wrote:
> As I had said on GitHub before, but to put it onto the list for
> visibility:
>
> I'd rather see the value in `php.ini-production` being changed to `Off`
> to match the built-in default. see
> https://github.com/php/php-src/pull/18215#issuecomment-2768618516

Thanks Tim,

Can you please explain why you think the default should be to always
show arguments? I asked this question in the Pull Request too and
didn't really get a clear answer. I did try to address your concerns
in the RFC itself.

To summarise:
* you referenced a stackoverflow chat asking about the difference, and
noting that the defaults for production and development should
probably be standardised as much as possible;
* you noted that the correct solution would be to set `display_errors`
to Off; and
* you also noted that the framework's error handler should be properly
configured.

In response to these I have extended the RFC to cover making the
development INI file the same as the production INI and default value
by setting all of these to the 'On' value.

Regarding setting `display_errors` to Off, I do agree, but I feel that
this is a separate RFC. I've highlighted this as future scope in the
RFC and I've also noted that there is often still value in displaying
errors without the arguments. That is to say that I feel that
display_errors should default to Off, and exception_ignore_args should
default to On.

Having defaults which do not reveal arguments unless explicitly
configured to do so is a much safer option than just showing
everything.

I do agree that the framework's error handler should be properly
configured, but mistakes happen and it is better to fail in as safe a
way as possible. The reality is that a framework that is configuring
the error handling properly is also capable of calling
`ini_set('zend.exception_ignore_args', 0);` during its own
initialisation and being explicit about wanting to have that
information. Developers are also able to configure their PHP
environment with developer appropriate configuration.

Ultimately mistakes can, and do, happen. PHP should be configured with
safe defaults as standard.