When we write programs, we will inevitably have problems (we often encounter problems), and when PHP encounters an error, it will give the location, line number and reason of the error script. A lot of people say it's not a big deal. Indeed, during the debugging phase, this really doesn't matter, and I think giving the error path is necessary.
But the consequences of leaking the actual path are unimaginable. For some intruders, this information is very important. In fact, many servers now have this problem. Some network administrators simply set display_errors in the PHP configuration file to Off to solve the problem (it seems like we did this), but I think this method is too negative.
Sometimes, we really need PHP to return error information for debugging. And when something goes wrong, you may also need to give the user an explanation or even navigate to another page.
So, what’s the solution?
set_error_handler()
PHP has provided the function set_error_handler() for custom error handling handlers since 4.1.0, but few script writers know it. The set_error_handler function can prevent error paths from being leaked, and of course has other functions.
The usage of set_error_handler is as follows:
<span>string</span> set_error_handler ( callback error_handler [, <span>int</span> error_types])
Now we use custom error handling to filter out the actual path. Suppose there is a variable $admin, which we use to determine whether the visitor is an administrator (this determination can be made by IP or logged in user ID)
<span>//</span><span>admin为管理员的身份判定，true为管理员。
</span><span>//</span><span>自定义的错误处理函数一定要有这４个输入变量$errno,$errstr,$errfile,$errline，否则无效。</span><span>function my_error_handler($errno,$errstr,$errfile,$errline)
{
</span><span>//</span><span>如果不是管理员就过滤实际路径 </span><span>if</span>(!<span>admin)
{
$errfile</span>=str_replace(getcwd(),<span>""</span><span>,$errfile);
$errstr</span>=str_replace(getcwd(),<span>""</span><span>,$errstr);
}
</span><span>switch</span><span>($errno)
{
</span><span>case</span><span> E_ERROR:
echo </span><span>"</span><span>ERROR: [ID $errno] $errstr (Line: $errline of $errfile) \n</span><span>"</span><span>;
echo </span><span>"</span><span>程序已经停止运行，请联系管理员。</span><span>"</span><span>;
</span><span>//</span><span>遇到Error级错误时退出脚本 </span><span>break</span><span>;
</span><span>case</span><span> E_WARNING:
echo </span><span>"</span><span>WARNING: [ID $errno] $errstr (Line: $errline of $errfile) \n</span><span>"</span><span>;
</span><span>break</span><span>;
</span><span>default</span><span>:
</span><span>//</span><span>不显示Notice级的错误 </span><span>break</span><span>;
}
} </span>In this way, an error handling function is customized, so what? What about handing over error handling to this custom function?
<span>//</span><span> 应用到类 </span>set_error_handler(array(&$<span>this</span>,<span>"</span><span>appError</span><span>"</span><span>)); </span><span>//</span><span>示例的做法 </span>set_error_handler(<span>"</span><span>my_error_handler</span><span>"</span>);
so easy, in this way, the contradiction between security and debugging convenience can be well solved. And you can also put some thought into making the error message more beautiful to match the style of the website.
The original author gave two points that need attention, I will post them here, hoping to attract the attention of our compatriots:
<span>//</span><span>先定义一个函数，也可以定义在其他的文件中，再用require()调用 </span><span>function myErrorHandler($errno, $errstr, $errfile, $errline)
{
</span><span>//</span><span>为了安全起见，不暴露出真实物理路径，下面两行过滤实际路径 </span> $errfile=str_replace(getcwd(),<span>""</span><span>,$errfile);
$errstr</span>=str_replace(getcwd(),<span>""</span><span>,$errstr);
</span><span>switch</span><span> ($errno) {
</span><span>case</span><span> E_USER_ERROR:
echo </span><span>"</span><span><b>My ERROR</b> [$errno] $errstr<br />\n</span><span>"</span><span>;
echo </span><span>"</span><span> Fatal error on line $errline in file $errfile</span><span>"</span><span>;
echo </span><span>"</span><span>, PHP </span><span>"</span> . PHP_VERSION . <span>"</span><span> (</span><span>"</span> . PHP_OS . <span>"</span><span>)<br />\n</span><span>"</span><span>;
echo </span><span>"</span><span>Aborting...<br />\n</span><span>"</span><span>;
exit(</span><span>1</span><span>);
</span><span>break</span><span>;
</span><span>case</span><span> E_USER_WARNING:
echo </span><span>"</span><span><b>My WARNING</b> [$errno] $errstr<br />\n</span><span>"</span><span>;
</span><span>break</span><span>;
</span><span>case</span><span> E_USER_NOTICE:
echo </span><span>"</span><span><b>My NOTICE</b> [$errno] $errstr<br />\n</span><span>"</span><span>;
</span><span>break</span><span>;
</span><span>default</span><span>:
echo </span><span>"</span><span>Unknown error type: [$errno] $errstr<br />\n</span><span>"</span><span>;
</span><span>break</span><span>;
}
</span><span>/*</span><span> Don't execute PHP internal error handler </span><span>*/</span><span>return</span><span>true</span><span>;
}
</span><span>//</span><span>下面开始连接MYSQL服务器，我们故意指定MYSQL端口为3333,实际为3306。 </span>$link_id=@mysql_pconnect(<span>"</span><span>localhost:3333</span><span>"</span>,<span>"</span><span>root</span><span>"</span>,<span>"</span><span>password</span><span>"</span><span>);
set_error_handler(myErrorHandler);
</span><span>if</span> (!<span>$link_id) {
trigger_error(</span><span>"</span><span>出错了</span><span>"</span><span>, E_USER_ERROR);
} </span>Okay, to summarize, here are three usages of set_error_handler:
<span>class</span><span> CallbackClass {
function CallbackFunction() {
</span><span>//</span><span> refers to $this </span><span> }
function StaticFunction() {
</span><span>//</span><span> doesn't refer to $this </span><span> }
}
function NonClassFunction($errno, $errstr, $errfile, $errline) {
}
</span><span>//</span><span> 三种方法如下: </span><span>1</span>: set_error_handler(<span>'</span><span>NonClassFunction</span><span>'</span>); <span>//</span><span> 直接转到一个普通的函数 NonClassFunction </span><span>2</span>: set_error_handler(array(<span>'</span><span>CallbackClass</span><span>'</span>, <span>'</span><span>StaticFunction</span><span>'</span>)); <span>//</span><span> 转到 CallbackClass 类下的静方法 StaticFunction </span><span>3</span>: $o =& <span>new</span><span> CallbackClass();
set_error_handler(array($o, </span><span>'</span><span>CallbackFunction</span><span>'</span>)); <span>//</span><span> 转到类的构造函数，其实本质上跟下面的第四条一样。 </span><span>4</span>. $o = <span>new</span><span> CallbackClass();
</span><span>//</span><span> The following may also prove useful: </span><span>class</span><span> CallbackClass {
function CallbackClass() {
set_error_handler(array(</span>&$<span>this</span>, <span>'</span><span>CallbackFunction</span><span>'</span>)); <span>//</span><span> the & is important </span><span> }
function CallbackFunction() {
</span><span>//</span><span> refers to $this </span><span> }
} </span>The above introduces the use of the PHP set_error_handler function, including the relevant aspects. I hope it will be helpful to friends who are interested in PHP tutorials.
![[Web front-end] Node.js quick start](https://img.php.cn/upload/course/000/000/067/662b5d34ba7c0227.png)
