Error Handling
Never display error details to users in production — stack traces reveal file paths, SQL queries, and framework internals. Log internally; show generic messages.
PHP
Beginner
3 min read
Secure Error Handling
Example
// Production php.ini
// display_errors = Off
// log_errors = On
// error_log = /var/log/php_errors.log
// In code
set_exception_handler(function (Throwable $e) {
error_log($e->getMessage() . " in " . $e->getFile() . ":" . $e->getLine());
http_response_code(500);
echo "An unexpected error occurred. Please try again.";
});
// Laravel: APP_DEBUG=false in production Pro Tip
A stack trace in the browser is a free recon report for attackers — log, do not display.