Search code examples
phpsecuritypdocentos

Password leak from PHP PDO object in error log

When error occurs while creating PDO connection (using wrong driver like sqlsrv instead of dblib I get error in /var/log/httpd/error_log (CentOS) with my plaintext database password and username in it:

[error] [client 10.10.103.16] PHP Fatal error:  Uncaught exception 'PDOException' with message 'could not find driver' in /var/www/html/index.php:1\nStack trace:\n#0 /var/www/html/index.php(1): PDO->__construct('sqlsrv:Server=O...', 'plainTextUserOMG!', 'plainTextPasswordOMG!')\n#1 {main}

How to cover this this data to still log error but not leak it into log file?

Solution

  • Put the calls in try{..} catch(){...} blocks to handle the exception manually. Read more here.