Question

I have read that displaying the the error messages in php on production servers is a security risk. Could you show an example of such an error message and how it can be vulnerable?

Answer 1

That’s because the error_message can contain potentially sensible information like

1. Information about paths on the server
2. Information about your database structure (Table names etc)
3. Information about the software you being using and its inner working (what CMS software are you using, which version , etc…)
4. Variable names
5. Information about potential risky PHP extensions you are using

(to be extended)

In short, it is possible that a remote user will gain information he has not to. This information may potentially being interesting for an attack. But its more about the potentially.

Or say it in other words, when you disable the displaying of error messages you fix a potential security risk