原文出处：http://devzone.zend.com/article/1745-PHP-Security-Tip-2
翻译：[email protected]

Security by obscurity is no security at all. On the other hand you don't want to give away information about your site either. Today's tip is a simple one but one that is often overlooked in production environments.

通过隐藏(信息)并不能从根本上保证安全。(但)另一方面你也不应该泄露任何有关你网站的信息。今天的技巧是非常简单的但也是经常被忽视的。

Make sure you do not display errors and potentially leak information about your site.
确保你没有将错误信息或是潜在的有关你网站的信息显示给外界

Simply setting display_errors = Off in your php.ini of your production server will prevent you from leaking information that may give intruders hints to the structure of your system. By default, display_errors = On.

在你的服务器上将 php.ini 文件中一个简单的设置改为 display_errors = Off 可以阻止将系统结构信息泄露给入侵者。在默认情况下这个设置为 display_errors = On.

You can find more information and error reporting options in the manual's Error Handling and Logging Functions Introduction section.

你可以找到更多有关错误报告的可选项以及信息，它们在手册的Error Handling and Logging Functions Introduction （错误处理以及loggin函数的介绍）章节

PHP 安全技巧连载 #1[译] PHP 安全技巧连载 #3[译]

评论 (0) All