note 125348 deleted from function.set-error-handler by cmb
| From: | cmb@php.net | Date: | Fri, 11 Sep 2020 11:44:17 +0000 |
| Subject: | note 125348 deleted from function.set-error-handler by cmb | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-215096@lists.php.net to get a copy of this message | ||
Note Submitter: lflobbe at ggd dot amsterdam dot nl
----
The error handler in example #1 is unsafe.
Specifically, this in unsafe:
<?php
echo "<b>My ERROR</b> [$errno] $errstr<br />\n";
?>
Instead, you should use:
<?php
echo "<b>My ERROR</b> [$errno] " . htmlspecialchars($errstr,
ENT_QUOTES) . "<br />\n";
?>
$errstr may contain user input. In the case of 'undefined index' and 'undefined
string offset' errors, the index or offset itself in included in the error string. In many
cases this index or offset was provided by the user.
Therefore, $errstr should be escaped before being echo'd in an html context.