Handling Sensitive Error Messages in Production

Show stable public error responses while logging safe diagnostic details server-side.

What It Does and When to Use It

Production settings prevent diagnostics being returned to public HTTP clients. Direct PHP code exposes the underlying operation clearly; a framework can supply lifecycle hooks, dependency wiring and retries.

Requirements, Inputs and Expected Behavior

Confirm the runtime, extension, environment variables, and permissions before running the examples in production. Exception messages can expose DSNs, filesystem paths, SQL statements and secrets.

Example 1: Basic Operation

Production settings prevent diagnostics being returned to public HTTP clients.

display_errors=Off
log_errors=On
error_reporting=E_ALL

Example 2: Behavior and Validation

Inspect effective SAPI settings; CLI and PHP-FPM load different INI files.

<?php
foreach (['display_errors','log_errors','error_log','memory_limit'] as $key) { echo $key, '=', var_export(ini_get($key),true), PHP_EOL; }

Practical Example: Application Use

Keep internal exception details out of the response and avoid logging credentials.

<?php
try { throw new RuntimeException('Private: DB connection failed'); }
catch (Throwable $e) {
    error_log('request_failure class='.get_class($e));
    http_response_code(500);
    echo 'An unexpected error occurred';
}

Important Behavior and Edge Cases

The second example highlights: Inspect effective SAPI settings; CLI and PHP-FPM load different INI files. The practical example adds: Keep internal exception details out of the response and avoid logging credentials.

Comparison with Related Approaches

Common Beginner Mistakes

Key Takeaways

• Show stable public error responses while logging safe diagnostic details server-side.
• Keep internal exception details out of the response and avoid logging credentials.
• Choose based on deployment requirements and verify actual behavior rather than assuming defaults.