mercredi 16 mars 2016

Would displaying PHP Exception Message be a security risk?

I want to set a custom message to be displayed to the user when I throw an error in Laravel 5.1. For example, in a controller I might have:

if(!has_access()){
    abort('401', 'please contact support to gain access to this item.');
}

Then my custom error page I would display the error with:

$exception->getMessage();

However, what if there was a SQL error or other event? Wouldn't that also set the Exception Message which I would be unknowingly outputting on my error page?

The PHP docs for getMessage() don't go into much detail about this.

How can I set a specific exception message without introducing any security risk?



via Chebli Mohamed

Aucun commentaire:

Enregistrer un commentaire