PHP Security / Overview / Error Reporting
Error Reporting
错误报告
In versions of PHP prior to PHP 5, released 13 Jul 2004, error reporting is pretty simplistic. Aside from careful programming, it relies mostly upon a few specific PHP configuration directives:
在 2004 年 7 月 13号发布的 PHP 5 和之间的版本里,错误报告功能都简单的过分。如果不考虑仔细编程的话,这个功能只能依靠几个特定的 PHP 配置选项。
-
This directive sets the level of error reporting desired. It is strongly suggested that you set this to
E_ALLfor both development and production. -
这个选项用来设置你希望报告错误的级别。强烈推荐你不管是开发还是发布,都设置为
E_ALL。 -
display_errorsThis directive determines whether errors should be displayed on the screen (included in the output). You should develop with this set to
On, so that you can be alerted to errors during development, and you should set this toOfffor production, so that errors are hidden from the users (and potential attackers). -
display_errors这个选项决定了是否要把错误信息显示到屏幕上(包含在页面输出中)。你应该在开发的时候设置成
On,以便于可以随时注意到错误,在发布的时候应该设置成Off,这样就能够对用户(和潜在的黑客)隐藏错误信息了。 -
log_errorsThis directive determines whether errors should be written to a log. While this may raise performance concerns, it is desirable that errors are rare. If logging errors presents a strain on the disk due to the heavy I/O, you probably have larger concerns than the performance of your application. You should set this directive to
Onin production. -
log_errors这个选项指定了是否要把错误信息写到日志中去。因为这个选项会增加系统负荷,所以只有在错误数量很少的时候这个选项才是可取的。由于记录错误引起的频繁 I/O 造成硬盘紧张,你可能需要更多地关注程序效率。在发布的时候应该把这个选项设置为
On。 -
This directive indicates the location of the log file to which errors are written. Make sure that the Web server has write privileges for the specified file.
-
这个选项配置了错误记录文件的位置。请确保 Web 服务器对这个文件有写权限。
Having error_reporting set to E_ALL will help to enforce the initialization of variables, because a reference to an undefined variable will generate a notice.
因为未定义的变量会引起一个 notice,所以把 error_reporting 设置为 E_ALL,能够强制开发者初始化变量。
NOTE:
Each of these directives can be set with ini_set(), in case you do not have access to php.ini or another method of setting these directives.
A good reference on all error handling and reporting functions is in the PHP manual:
http://www.php.net/manual/en/ref.errorfunc.php
PHP 5 includes exception handling. For more information, see:
http://www.php.net/zend-engine-2.php
注:
上面说的这些选项都可以通过 ini_set()函数设置,以防万一你没有访问 php.ini 的权限或者没有其他的方法设置这些选项。
在 PHP 手册里有很好的关于错误处理和报告相关函数的参考:
http://www.php.net/manual/en/ref.errorfunc.php
PHP 5 包含了异常处理。如果需要更多的信息,请参见:
http://www.php.net/zend-engine-2.php