Too much information, PHP error?

Question

I'm making a custom wrapper for the mysql_ functions when MySQLi, e.g. isn't available, and when it can't connect, it throws an exception. However, the fatal error output is this:

Fatal error: Uncaught exception 'Exception' with message 'Failed to connect to database.' in C:\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\MiniTicket\database.php:16

Stack trace:

#0 C:\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\MiniTicket\database.php(49): MySQL->__construct('localhost', 'miniticket', 'mtu:r!Nj@~qR6f9...')
#1 C:\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\MiniTicket\index.php(3): require_once('C:\Program File...')
#2 {main} thrown in C:\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\MiniTicket\database.php on line 16

As you can see, my database password is clearly displayed for everyone to see. Not good. I don't want to turn these messages off, especially in development, but I don't want sensitive information displayed either. Using set_error_handler is also not a great solution, because I have to parse everything, and that's prone to error.

So... is there an easy way to disable the display of the parameters in a function inside an error message, preferably through PHP and not in some configuration file?

Edit: Disabling the filepath except for the filename would be a bonus, too.

Answer 1

You should separate your error handling between production and development where development displays the error information and production shows a friendly error message but does not output anything PHP does. Log the output to file instead.

Answer 2

Edit your php.ini and set

display_errors = 0

If you don't have access to php.ini then at the top of your script(s) you need to add:

ini_set("display_errors", "0");

See http://php.net/manual/en/errorfunc.configuration.php and http://php.net/manual/en/function.error-reporting.php

This will stop all errors from being outputted to the browser, and should probably only be done on your production system. Make sure you are still logging errors (via php.ini setting).

I'm not sure why this isn't the default configuration so that this situation doesn't happen in production environments.

Don't treat this as a solution to your software problem though, this is just meant to stop sensitive data from being displayed to the public.

Note that you may need to restart Apache for the php.ini changes to take effect.