Logging PHP Errors Safely in Production

Write server-side errors with redacted context and stable request identifiers.

What It Does and When to Use It

Production settings prevent diagnostics being returned to public HTTP clients. Direct PHP code exposes the underlying operation clearly; a framework can supply lifecycle hooks, dependency wiring and retries.

Requirements, Inputs and Expected Behavior

Confirm the runtime, extension, environment variables, and permissions before running the examples in production. display_errors should be off in production; never log full authorization headers.

Example 1: Basic Operation

Production settings prevent diagnostics being returned to public HTTP clients.

display_errors=Off
log_errors=On
error_reporting=E_ALL
log_errors_max_len=0

Example 2: Behavior and Validation

Inspect effective SAPI settings; CLI and PHP-FPM load different INI files.

<?php
foreach (['display_errors','log_errors','error_log','memory_limit'] as $key) { echo $key, '=', var_export(ini_get($key),true), PHP_EOL; }

Practical Example: Application Use

Keep internal exception details out of the response and avoid logging credentials.

<?php
try { throw new RuntimeException('Private: DB connection failed'); }
catch (Throwable $e) {
    error_log('request_failure class='.get_class($e));
    http_response_code(500);
    echo 'An unexpected error occurred';
}

Important Behavior and Edge Cases

The second example highlights: Inspect effective SAPI settings; CLI and PHP-FPM load different INI files. The practical example adds: Keep internal exception details out of the response and avoid logging credentials.

Comparison with Related Approaches

Common Beginner Mistakes

Key Takeaways

• Write server-side errors with redacted context and stable request identifiers.
• Keep internal exception details out of the response and avoid logging credentials.
• Choose based on deployment requirements and verify actual behavior rather than assuming defaults.