note 125348 added to function.set-error-handler

The error handler in example #1 is unsafe. Specifically, this in unsafe: <?php echo "<b>My ERROR</b> [$errno] $errstr<br />\n"; ?> Instead, you should use: <?php echo "<b>My ERROR</b> [$errno] " . htmlspecialchars($errstr, ENT_QUOTES) . "<br />\n"; ?> $errstr may contain user input. In the case of 'undefined index' and 'undefined string offset' errors, the index or offset itself in included in the error string. In many cases this index or offset was provided by the user. Therefore, $errstr should be escaped before being echo'd in an html context. ---- Server IP: 45.112.84.4 Probable Submitter: 103.51.167.36 (proxied: 94.168.47.114) ---- Manual Page -- http://php.net/manual/en/function.set-error-handler.php Edit -- https://master.php.net/note/edit/125348 Del: integrated -- https://master.php.net/note/delete/125348/integrated Del: useless -- https://master.php.net/note/delete/125348/useless Del: bad code -- https://master.php.net/note/delete/125348/bad+code Del: spam -- https://master.php.net/note/delete/125348/spam Del: non-english -- https://master.php.net/note/delete/125348/non-english Del: in docs -- https://master.php.net/note/delete/125348/in+docs Del: other reasons-- https://master.php.net/note/delete/125348 Reject -- https://master.php.net/note/reject/125348 Search -- https://master.php.net/manage/user-notes.php