01 Jun 2007

Hide PHP errors using htaccess

By default, the PHP display_errors setting is set on. You can read more about display_errors at PHP: Error Handling and Logging Functions. There are few important things that you should know about the error messages that is sent to the browser by display_errors.

Usually these error messages contains sensitive information about the web application environment that you are running and could lead to unwanted security threat. It is even stated in the manual that it is not recommended to enable this feature on a production site.

To disable or switch it off (assuming that you’re on a shared hosting which have limited super power), simply add php_flag display_errors off in your .htaccess file.

13 Comments

  1. vm

    cool. simple good if don’t have access to php.ini file.

    Reply

  2. Jc

    This is also useful to turn errors on while editing php files on a shared web server (no access to php.ini).

    Reply

  3. Ambareesh Shrivastav

    Cool tip. I had read about turning PHP errors off at a lot of places but no body had bothered to mention the complete code ie php_flag….
    Thanks

    Reply

  4. i dont know how to thank u man … i needed that urgently … u r a real geniuos

    Reply

  5. Biswa

    Great tips

    Reply

  6. John B

    you can also always add this to the code:

    ini_set(“display_errors”,”1″);

    Reply

  7. B That usually works, but if there’s a parse error the script will terminate before the ini_set() function can be executed. So if you, for example, forget a semi-colon; you will not see the error message.

    Reply

  8. Thank you for this article on: Hide PHP errors using htaccess This has been my prob for a week. I’m new at this, how exactly do I get to my .htaccess file. ? Is it in the FTP? And how exactly do I add: php_flag display_errors off

    Reply

  9. Usefull to avoid Full Path Disclosure vulnerability with php errors.

    Reply

  10. WPS

    Fantastic. I’ve been looking for a way to do this on shared hosting (without access to php.ini).

    Is there a way to display a friendly “oops” type page as well?

    Reply

  11. dennis

    guys i have a 500 internal sever error when i put that in. Help please

    Reply

    • Mark

      If you got the 500 error you may simply have a typo in the .htaccess file from when you attempted to add the php flag…

      Reply

  12. Thank You Man, Thank You Very Much.

    Reply

Leave a Reply