12

I was wondering if php programmers keep error_reporting in php.ini on or off after delivering the website?

1 Answers1

18

You should always keep on error reporting, logging of most important events and audit. Otherwise, the day your application will fail for some reason, you'll have a hard time to figure out what happened.

This being said, error reporting must be done internally, and never shown to the end user, since it would be a security issue to show sensitive information. You can use display_errors and log_errors settings for this: in php.ini-production, the first is set to off, while the second is on.

By the way, php.ini-production already answers your question:

; error_reporting
;   Default Value: E_ALL & ~E_NOTICE
;   Development Value: E_ALL | E_STRICT
;   Production Value: E_ALL & ~E_DEPRECATED

Another comment also tells you that:

By default, PHP is set to take action on all errors, notices and warnings EXCEPT those related to E_NOTICE and E_STRICT, which together cover best practices and recommended coding standards in PHP. For performance reasons, this is the recommend error reporting setting. Your production server shouldn't be wasting resources complaining about best practices and coding standards.

Arseni Mourzenko
  • 135,365
  • Thanks for the answer. It is very obvious that error reporting is very useful while a website is developed but I was confused if the developers turn it off after the website is created so that the client does not see any of the errors. Thanks for clearing the concept. –  Jan 14 '12 at 15:40
  • If a developer turns error_reporting off in production, (s)he has likely something to hide. – Lekensteyn Jan 14 '12 at 20:08
  • You do want to turn of debug and trace level logging in production. Error level reporting is essential when things go wrong. Most sites will want informational logging enabled if it is done appropriately. – BillThor Jan 15 '12 at 16:13
  • @FahadUddin You don't want viewers of your website/application to see errors. The only thing we restrict is the display of errors to the end user, logging takes care of the rest. However, good practice dictates that in the event of an application level error (bad DB connection for example) that we inform the end user something went wrong and on the backend alert the developers immediately. – Ian Lewis Jan 09 '14 at 10:05