Jan 27, 2012

f Comment

How do You Hide PHP Error Messages When Rendered In the Web Browser?

Amazon If you are using PHP to develop your website chances are you don't want PHP errors to show on your production website even when your PHP code generates syntax or logic error when it runs. An example of such an error is the following:


PHP Error
Description

Invalid argument supplied for foreach()

Source File
C:\repository\trunk-php\protected\controllers\helpers\MainControllerHelper.php(182)
00170:         return $finalBreadcrumbs;
00171:     }
...
00182: foreach($bc as $property => $levelOneMap){
00183: foreach($levelOneMap as $levelOneName => $levelOneUrl){ 00184: $canonicalPath .= $levelOneName . ' '; 00185: } 00186: } 00187: $bc['canonicalPath'] = StringUtil::cleanUpPath($canonicalPath); ... 00191: } 00192: 00193: // return empty array or entity name such as 00194: // ['T Shirt']='t-shirt'

Stack Trace
#0 C:\repository\trunk-php\protected\controllers\helpers\MainControllerHelper.php(167): insertCanonicalDataByBreadcrumbs()
#1 C:\repository\trunk-php\protected\controllers\helpers\MainControllerHelper.php(354): constructBreadcrumbFromPath()
#2 C:\repository\trunk-php\protected\controllers\MainController.php(126): redirectToNewUrlIfNeeded()
...
#13 C:\repository\yii\framework\web\CWebApplication.php(121): CWebApplication->runController()
#14 C:\repository\yii\framework\base\CApplication.php(135): CWebApplication->processRequest()
#15 C:\repository\trunk-php\index.php(21): CWebApplication->run()


Ugly isn't it? While someone is browsing your website you certainly don't want them to witness the big red PHP Error and pointer to how the error is generated and even a stack trace to help you debug. You want your visitors to see some custom 404 error page or simply 301 redirect to the homepage. Read on to see the solution!

Solution
In your PHP configuration file, or php.ini, you should suppress PHP errors by setting the configurations properly. Here are the relevant settings:

php_flag display_errors off
php_flag display_startup_errors off
php_flag html_errors off
php_value docref_ext 0
php_value docref_root 0

You can log your website's PHP errors and even disable logging of repeated errors. They can all be found in the standard PHP configurations online manual. A simple Google search will help. What Google doesn't tell you is the situation where you've set all the above settings properly and are still seeing PHP error messages in the web browser. Why? The reason is simple: These settings are being set DYNAMICALLY in your PHP application somewhere. For example somewhere in your source code you may see the following to set the error_reporting configuration:

error_reporting(E_ALL & ~E_NOTICE);
Read on to see what you can do about it.

What Can I Do?
Unfortunately you'll need to go through your source code to see where the error message reporting is set off. This is simple if you've developed your code from scratch and know where things are. If however you are using some framework that'll be more of a headache because somewhere under the hood deep in the framework some setting is set dynamically and you won't know until you either explore their framework's source code thoroughly OR you go through the tutorial to find the proper way to not trigger this behavior.

If you are using Yii Framework you are in luck..
Because I use it too and am very familiar with it. Go to your entry point script, usually called index.php, and you should see the following code:
...
// remove the following lines when in production mode
defined('YII_DEBUG') or define('YII_DEBUG',true);
...
Simply do what it tells you and remove the line and you will no longer see the error message. Control will end prematurely the function where the PHP error occurs and continue until it reaches the view and renders it.

If you are NOT using Yii Framework...
Just follow the tutorial of whatever the framework you are using. Or do a global search for the relevant runtime function calls such as error_reporting, display_startup_errors, html_errors, etc. With time and effort you'll find them and follow the logic to see how to NOT trigger them.

Redirect when an error occurs?
Obviously it's your job to make sure your PHP application does NOT generate errors no matter how hard and wild your visitors play with it. One easy thing you can do it simply 301 redirect to your homepage when an error occurs. Here's the PHP code in Yii Framework:

$controller->redirect('/',true,301);
Happy coding! Questions? Let me know!
Please leave a comment here!
One Minute Information - by Michael Wen
ADVERTISING WITH US - Direct your advertising requests to Michael