Error Handler Library

From OWASP
Jump to: navigation, search

Introduction:

Unlike other languages like Java, in PHP "Exceptions" are handled in a different way than "Errors". In PHP, any anomaly in the logic such as "Divide by zero" are considered as errors and things such as "Trying to access a private property" is considered as "Exceptions". "Exceptions" are thrown in PHP like any other language, but "Errors" are not thrown and they need to be converted to "Exceptions" and thrown accordingly by the programmer. This introduces many confusion among developers as they are accustomed to treat everything as an "Exception" and expect them to be thrown automatically.

Need for this Library:

PHP has a mechanism that allows the developers to set functions that they can register in case any error is generated. This function, once registered, is called whenever an error is generated and then it will be converted to an "Exception" and then will be thrown. In this library we take this task to register the function and to convert them to an "Exception" from the developers and do it ourselves so that they do not have to worry about this. This library first registers the function that converts "Errors" to "Exceptions" so that PHP can call this function and handle it properly in case any "Error" is generated. This function also has the job to convert the PHP "Error" to "Exception". The name of the exception that is produced after the conversion is "ErrorException".

PHPSEC Error Handling Implementation:

As per PHP requirements, we first need to define functions to register the function and then to shutdown the function. Then we need to define other methods such as method to convert the error to exceptions. Below is the list of all the function and their uses:

  • enable: This method sets the phpsec error handler as error handler. What we mean is that once the developers calls this function, the PHP's own error handler passes the authority to handle PHP errors to this function. This function checks if the function is already registered or not and if not registered, this method registers our error handler using PHP's "set_error_handler" function. Similarly it also checks if the shutdown function is registered or not and if not registered, it registers our own shutdown function using "register_shutdown_function". In addition to all the above mentioned task, it also saves the PHP's current error reporting state for in case the user wants to turn off our error reporting mechanism, they can go back to their own PHP's error reporting mechanism.
  • disable: This function does the exact opposite of the "Enable" function. It first checks if the methods have been register or not and if registered, then it un-register them and reverts back to PHP's old error mechanism using "error_reporting()" and "restore_error_handler()" method.
  • isActive: This function checks the if our error mechanism is currently active or not.
  • _shutdown: This is registered as a shutdown function to catch fatal errors. It means that if PHP encounters some fatal errors that is causing the whole application to fail, then it calls this shutdown function before failing, thus giving the application a last chance to correct the fatal error and to save the application or to handle the error gracefully. Our implementation of this function only considers "E_ERROR", "E_CORE_ERROR", "E_PARSE", "E_COMPILE_ERROR" and "E_USER_ERROR" as fatal and simply warns the user of this error before failing the application.
  • _errorToException: This function converts the PHP's error to "Exceptions". The exception that is generated is called "ErrorException".
  • dump: It dumps an exception in readable format


Other Helpful Links: