Search code examples
phpsecurityxsssql-injection

Whether error_reporting(0) in php prevent hacking

Whether using error_reporting(0) in php script will prevent hacking using SQLi or XSS by not reporting error?

Solution

  • Using error_reporting(0) is plain dangerous; you're hiding warnings that could give vital clues to shaky coding. At the same time it won't prevent SQL injection issues or xss.

    My advice: set error_reporting(-1) at all times and either log all errors using error_log or write a custom error handler using set_error_handler() to handle the errors without showing them on the page. During development you should always enable display_errors as well.

    Note that nothing but good coding practices and proper testing can mitigate hacking, but preventing it altogether takes even more. Adopt defensive programming or perhaps ask Bernstein to tutor you ;-)