PHP custom error page

问题:

Everyone says that "Enabling errors to be shown" in an active site is bad (due to some security issues).

Now, we have to consider 2 cases:

1. The site is in debug mode
2. The site is not in debug mode

Now, for case #1:

We want to see the errors. How?

ini_set('error_reporting', E_ALL);
ini_set('display_errors', 1);

Nothing more simple. Also we can customize an error handler for all errors except Parse and Fatal.

Instead, if the case is #2:

We would like to be able to deactivate the messages:

ini_set('error_reporting', 0);
ini_set('display_errors', 0);

And it's ok. But what about showing users a friendly message such as "Hei man, something is really f**ked up. I don't assure you we are working to fix it, since we are very lazy.". You should enable errors again and just use the function set_error_handler() and hope that no parse or fatal errors occur. But my first question is:

Question 1: Is that possible to avoid error reporting and have a custom offline page that is loaded when something goes wrong? I mean, is it possible to have ini_set('error_reporting', 0); and ini_set('display_errors', 0); and still be able to tell PHP to load a custom Error page?

And now another:

Question 2: I developed a class that with the power of set_error_handler() logs errors occurred into the database. In this way I can keep track of hack attempts and other cool stuff. (And yes, i'm always sure the DB is accessible since my application shuts down if we cannot connect to the DB). Is this worth something?

回答1:

Some time ago I created small system that redirects you to error page when fatal error occurs / uncaught exception was thrown. It was possible with assumption, that every request is handled by one file and ends in this file, so by reaching end of this file I'm sure that everything went OK. With this condition I've set up function to redirect on error page and registered it as shutdown function - so it will be called at the end of all requests. Now in this function I check conditions for clean shutdown and if hey are met, I do nothing and output is flushed to the browser, otherwise buffer is cleaned and only header redirecting to error page is sent.

Simplified version of this code:

<?php
function redirect_on_error(){
    if(!defined('EVERYTHING_WENT_OK')){
        ob_end_clean();
        header('Location: error.html');
    }
}

register_shutdown_function('redirect_on_error');

ob_start();

include 'some/working/code.php';

echo "Now I'm going to call undefined function or throw something bad";

undefined_function();
throw new Exception('In case undefined function is defined.');    

define('EVERYTHING_WENT_OK', TRUE);
exit;

回答2:

Question 1: Is that possible to avoid error reporting and have a custom offline page that is loaded when something goes wrong?

Unfortunately, I don't think so, at least for fatal errors. However, recent versions of PHP always send a 500 response when that occurs, so, depending on webserver, you may be able to rewrite the response if such thing happens. If your actual server running PHP is behind a reverse proxy, this becomes trivial with Apache.

Question 2: I developed a class that with the power of set_error_handler() logs errors occurred into the database.

Sure, it's always good to log the errors. You already seem to be aware of the limitations of logging errors into the database.