PHP

Error Handling & Reporting

Error HandlingNever allow a default error message or error number returned by the mysql_error() and mysql_errno() functions to be displayed to the public. Any error messages viewable by the public should be customised (confidential information stripped out) and made to look more user-friendly

• Information returned by mysql_error() and mysql_errno() functions may expose vulnerabilities of the server, providing a means of attacking it.

• In a production environment, scripts should be written to display a user friendly custom error message not revealing information about the PHP scripting engine or the MySQL database.

• A script can be included to write the error code and error message to a log file in a secure area (not in the public accessible folders)

Default error messages• In this example an attempt is made to divide by 0 (impossible),

and an error message appears when the script is parsed

• The error message exposes the location of the file in the server’s directory structure to visitors or potentially any hackers.

set_error_handler() function• A customised error

function creates a less intrusive error message and hides confidential information frompotential hackers.

• The set_error_handlerfunction is used to customise how error reporting occurs

• Screen output:

Error Reporting Level• Setting the error reporting level to 0 switches error reporting off.• In this example, dividing 3 by 0 is impossible and would normally

throw an error. • In this case the error reporting level is set to 0 so the error is not

exposed• The calculation does not take place.

What to do with error information?• Save the error to a database or to a local text file• Redirect the user to another page• Provide a user-friendly customised error message to avoid putting

people off the website• Store the date/time of the error• Write a script to email errors to the web master

Best Practices?• Always avoid errors being displayed in the live environment

(public)• If errors occur in the script when run, make sure the errors are

logged somewhere secure.• Best practice is to avoid errors occurring in the first place

Form Validation• Validate user input – this reduces the risk of being hacked.• PHP scripts used to validate user input are server –side and more

secure than JavaScript form validation scripts• JavaScript can be turned off in the browser by the user, rendering

JavaScript ineffective.

htmlspecialchars() • The htmlspecialchars() function converts special characters to

HTML entities. This means that it will replace HTML characters like < and > with &lt; and &gt;. This prevents attackers from exploiting the code by injecting HTML or Javascript code (Cross-site Scripting attacks) in forms

<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>">

File uploadsTo prevent the user uploading a file such as an executable or a file that could be a security risk, add an IF statement to validate user input. For example, restrict the user to uploading only GIF or JPG files. To use or, use the || characters.

Error Control Operator

@

Place in front of the variable name to tell server to ignor error if it occurs. E.g. if user user has not inputted their name on a form, the variable $name will not exist, so the @ symbol ignors this.

.htaccess• Use .htaccess to restrict folder access

• Username: alansebrill• Password: journey • Encrypted algorithm:

alansebrill:$apr1$9.m5dEw/$CkD0Nwueiiv0JpmYbXlTr0