Question

Can I hide the path in php error using .htaccess

Example:

Notice: Undefined variable: hello in C:\xampp\htdocs\mysite\index.php on line 3

I want to hide the path using .htaccess or print something let me know if there is an error without print the path of the page:

Notice: Undefined variable: hello on line 3

or

Notice: Undefined variable: hello

or

There is error in your page

Edit :

I put this lines in my .htaccess
But I can’t access to my site. There is error “Internal Server Error”
How Can I fix that

# supress php errors
php_flag display_startup_errors off
php_flag display_errors off
php_flag html_errors off
php_value docref_root 0
php_value docref_ext 0

Answer 1

PHP’s error messages are not meant for users but for developers only.

So for a production environment, you should disable display_errors to avoid information disclosure:

Note: [display_errors] is a feature to support your development and should never be used on production systems (e.g. systems connected to the internet).

Instead, you should show generic error messages to your users that do not unveil anything of the internals and only log the error messages (see log_errors and error_log):

Note: You’re strongly advised to use error logging in place of error displaying on production web sites.

And if you really want to modify PHP’s error messages, you can use set_error_handler to set a custom error handler.

See also OWASP’s Development Guide on “Error Handling, Auditing and Logging” for further information.