3 ms·
Just put: display_errors = Off is your php.ini and you will never see any errors. This is recommended everywhere for a PHP deployment. ; This directive con
by Loic 16y ago
Just put: display_errors = Off is your php.ini and you will never see any errors. This is recommended everywhere for a PHP deployment.
; This directive controls whether or not and where PHP will output errors,
; notices and warnings too. Error output is very useful during development, but
; it could be very dangerous in production environments. Depending on the code
; which is triggering the error, sensitive information could potentially leak
; out of your application such as database usernames and passwords or worse.
; It's recommended that errors be logged on production servers rather than
; having the errors sent to STDOUT.
; Possible Values:
; Off = Do not display any errors
; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)
; On or stdout = Display errors to STDOUT
; Default Value: On
; Development Value: On
; Production Value: Off
; http://php.net/display-errors
display_errors = Off
- russss 16y agoI guarantee you that Tumblr has display_errors = Off. This wasn't a display_errors related fuckup, it was a missed opening PHP tag.
- nbpoole 16y agoWell, based on the code that was dumped, it looks like they're using their own error handler which was ignoring display_errors (search for "Use of undefined constant" in the dump).
- CWIZO 16y agoThat custom error handler was never set, because the code you see above never even executed. The reason was, like said many times already, a miss-typed opening PHP tag, which tells PHP where PHP code is. If that tag is missing or miss-typed the code is just returned to the browser like HTML. The point is that no server configuration can save you from an error like this.
- nbpoole 16y agoIf the custom error handler was never set, the PHP notices wouldn't look like that.
- moe 16y agoThe point is that no server configuration can save you from an error like this. Huh? Yes you can protect against errors like this; http://news.ycombinator.com/item?id=2343675 http://news.ycombinator.com/item?id=2343675
- eli 16y agoWell, off the top of my head, mod_security has rules that scan outgoing data for password or code leakage. A deployment strategy that requires testing that pages show what you expect them to show would also likely catch it.
- KevBurnsJr 16y agoWell, this is partially true. The output clearly contains error statements, but this directive would not have stopped the first 748 lines of sensitive information from leaking before the first error.