"Please, fix the problems instead of hiding them." I want to comment about this conclusion, lest anyone reading it actually follow the author's advice. You sh

"Please, fix the problems instead of hiding them." I want to comment about this conclusion, lest anyone reading it actually follow the author's advice. You should absolutely be hiding notices/errors from appearing. This is orthogonal to whether or not the errors should be allowed to occur. When during the course of assessing a web application I (or anyone who does this for a living) gets an error message generated by the framework or server (like ASP.NET's yellow screen of woe), that's an issue (albeit usually a low severity issue). If that error can display user input in a non-sanitized fashion, it's a more severe error. The recommendation isn't to "make sure the application doesn't generate any errors" (although, hey, that's a great thing to shoot for), it's to capture those errors and not display them to the user (usually by displaying a generic error message that doesn't leak useful information to an attacker). This includes things like disabling debug functionality.