Secure password transfer (stack trace problem)

Question

I noticed that my server's php_errors.log dev file appeared again after my previous bug fix, but this time I noticed something rather alarming ...

[06-Jan-2016 01:29:29 UTC] PHP Fatal error: Uncaught PDOException: SQLSTATE [HY000] [2002] There is no such file or directory in / home / niet / public _html / classes / DB.class.php: 14
Stack trace:
# 0 / home / niet / public_html / classes / DB.class.php (14): PDO → __ construct ('mysql: host = loca ...', 'niet', ' MY ACTUAL PASSWORD! ', array)
# 1 / home / niet / public_html / classes / DB.class.php (47): DB :: connect ()
# 2 ...

Needless to say, this is a problem. So basically, my question is very simple:

How to pass a string to a function without it appearing in the stack trace if something goes wrong?

In an attempt to be smart, I tried this:

new PDO(
    "mysql:host=localhost.....",
    "niet",
    new class { public function __toString() { return "correct horse battery staple"; }}
);

As long as it is successfully connected to the database, the thrown exception (for example, the wrong password) still shows the string value, and not an anonymous class. A similar problem occurs if I use a "normal" class to try to "hide" a variable from the trace.

Answer 1

In a production environment, you should disable any error messages. Install display_errors = offPHP.ini in your file to not reveal any information about your server.

, $pdo->setAttribute(PDO::ERRMODE_SILENT) PDO. manual .

//: :

$pdo = new PDO($server, $user, $password);

// Let us assume that 'foo' column does not exist
$query  = 'SELECT foo FROM bar';
$result = $pdo->query($query);

// Log error message
if ($pdo->errorInfo()) {
  print_r($pdo -> errorInfo());
}

Answer 2

, .

function exception_handler($e) {
    echo "<b>Exception in file: </b>" . $e->getFile() . "<br>";
    echo "<b>Exception on line: </b>" . $e->getLine() . "<br>";
    echo "<b>Exception message: </b>" . $e->getMessage();
}

set_exception_handler('exception_handler');

, , :

: C:\xampp\htdocs\path\file.php
: 220
: SQLSTATE [HY000] [1045] 'root' @'localhost' ( > password: YES)