We write programs, will inevitably have problems (is often encountered problems), and PHP encountered errors, it will give the location of the error script, line number and reason. A lot of people say it's not a big deal. Indeed, in the debugger phase, this is really nothing, and I think it is necessary to give the wrong path.
But the consequences of revealing the actual path are unthinkable, and for some intruders, this information is very important, and in fact there are many servers that are now in question. Some network administrators simply put the PHP configuration file in the Display_errors set to off to solve (it seems we are doing this), but I think this method is too negative.
There are times when we really need PHP to return the wrong information for debugging. And you may need to give the user an account when you make an error, or even navigate to another page. So, what's the solution?
Set_error_handler ()
PHP provides a functional function of custom error handling handles Set_error_handler () from 4.1.0, but very few scripting people know. Set_error_handler This function is a good way to prevent the wrong path from leaking, and of course, there are other effects.
can be used to mask errors. An error can cause some information to be leaked to the user, which is very likely to become a tool for hackers attacking your site. Secondly let the user feel your level is very frustrated.
You can write down the wrong information and find some problems in the production environment in time.
Can do the corresponding processing, when the error can show jump to a predefined error page, provide a better user experience.
As a debugging tool, there are times when you have to debug something in a production environment, but you don't want to affect the users you are using.
The use of Set_error_handler is as follows:
Copy Code code as follows:
String Set_error_handler (callback Error_Handler [, int error_types])
Now we're going to filter out the actual path with custom error handling. Suppose there is a variable $admin, we are used to determine whether the visitor is an administrator (you can make this decision by IP or by the user ID of the login).
Copy Code code as follows:
Admin for Administrator's identity, true to administrator.
Custom error-handling functions must have these 4 input variables $errno, $errstr, $errfile, $errline, otherwise invalid.
function My_error_handler ($errno, $errstr, $errfile, $errline)
{
Filter the actual path if it is not an administrator
if (!admin)
{
$errfile =str_replace (GETCWD (), "", $errfile);
$errstr =str_replace (GETCWD (), "", $errstr);
}
Switch ($errno)
{
Case E_ERROR:
echo "ERROR: [ID $errno] $errstr (line: $errline of $errfile) \ n";
Echo program has stopped running, please contact the administrator. ";
Exit script when error level errors are encountered
Exit
Break
Case e_warning:
echo "WARNING: [ID $errno] $errstr (line: $errline of $errfile) \ n";
Break
Default
Do not show notice-level errors
Break
}
}
This allows you to customize an error-handling function, so how do you give the wrong handling to this custom function?
Copy Code code as follows:
Apply to Class
Set_error_handler (Array (& $this, "Apperror"));
Examples of practices
Set_error_handler ("My_error_handler");
So easy, this can be a good way to solve the security and debugging convenience contradictions. And you can also spend some thought, make the error hint more beautiful to match the website style.
The original author gave two points need to pay attention to the place, I also let it out, I hope to arouse the attention of our fellow citizens:
1, E_error, E_parse, E_core_error, e_core_warning, E_compile_error, e_compile_warning will not be handled by this handle, which is the most original way to display. However, these errors are either compiled or the PHP kernel fails, which is not normally the case.
2, the use of Set_error_handler (), error_reporting () will be invalid. That is, all errors (except those mentioned above) will be handed to the custom function for processing.
Finally, an example
Copy Code code as follows:
You define a function, you can define it in another file, and then use require () to call
function MyErrorHandler ($errno, $errstr, $errfile, $errline)
{
For security reasons, do not expose the real physical path, the following two lines filter the actual path
$errfile =str_replace (GETCWD (), "", $errfile);
$errstr =str_replace (GETCWD (), "", $errstr);
Switch ($errno) {
Case E_USER_ERROR:
echo "<b>my error</b> [$errno] $errstr <br/>\n";
echo "Fatal error on line $errline in file $errfile";
echo ", PHP". Php_version. " (" . Php_os. ") <br/>\n";
echo "Aborting...<br/>\n";
Exit (1);
Break
Case e_user_warning:
echo "<b>my warning</b> [$errno] $errstr <br/>\n";
Break
Case E_user_notice:
echo "<b>my notice</b> [$errno] $errstr <br/>\n";
Break
Default
echo "Unknown error type: [$errno] $errstr <br/>\n";
Break
}
/* Don ' t execute PHP INTERNAL Error handler * *
return true;
}
Below begins to connect MySQL server, we intentionally specify MySQL port is 3333, actual is 3306.
$link _id= @mysql_pconnect ("localhost:3333", "root", "password");
Set_error_handler (MyErrorHandler);
if (! $link _id) {
Trigger_error ("Made a mistake", e_user_error);
}
