4 ms·
As the OP points out this shouldn't be an issue on production systems as display_errors shouldn't be turned on. From the PHP docs [1]: This is a feature t
by hartror 15y ago
As the OP points out this shouldn't be an issue on production systems as display_errors shouldn't be turned on.
From the PHP docs [1]:
This is a feature to support your development and should never be used on production systems (e.g. systems connected to the internet).
Of course how many of the notoriously lazy/incompetent PHP developers we have all had to deal with in our lives have RTFM.
So could PHP perhaps HTML encode error messages? Would this break any error message use cases? For example are there times when error messages appear when they wouldn't be interpreted as HTML encoded? CLI? Browsers loading different text mime types?
[1] http://www.php.net/manual/en/errorfunc.configuration.php#ini.display-errors http://www.php.net/manual/en/errorfunc.configuration.php#ini...
- nbpoole 15y ago> So could PHP perhaps HTML encode error messages? Would this break any error message use cases? For example are there times when error messages appear when they wouldn't be interpreted as HTML encoded? CLI? Browsers loading different text mime types? This is something PHP already gets right with warnings, fatal errors, etc. The issue is only with notices as far as I've seen (I haven't delved into the PHP source to see what the difference is). A demonstration file: [cmd]$ cat 147b9119e818c92f7f74bad71cc12255.php <?php echo file_get_contents('<s>test</s>'); Compare: [cmd]$ php -f 147b9119e818c92f7f74bad71cc12255.php Warning: file_get_contents(<s>test</s>): failed to open stream: No such file or directory in /home/nbsandbox/sandboxing.me/poc/147b9119e818c92f7f74bad71cc12255.php on line 2 to http://sandboxing.me/poc/147b9119e818c92f7f74bad71cc12255.php http://sandboxing.me/poc/147b9119e818c92f7f74bad71cc12255.ph... <br /> <b>Warning</b>: file_get_contents(<s>test</s>) [<a href='function.file-get-contents'>function.file-get-contents</a>]: failed to open stream: No such file or directory in <b>/home/nbsandbox/sandboxing.me/poc/147b9119e818c92f7f74bad71cc12255.php</b> on line <b>2</b><br />
- georgefox 15y agoI know what you mean, but the link you provided doesn't actually seem to be doing any HTML encoding.
- nbpoole 15y agoHaha, whoops! Sorry about that, back to normal. Anyone who hit that URL in the past 10 minutes would have seen unsanitized HTML, because I was testing the impact of disabling the html_errors INI option (something one of my blog's comments asked about). I've updated the blog post to discuss html_errors as well. ;-)