PDO Error Handling

Also Known As

TL;DR

Explanation

PDO::ERRMODE_SILENT (default) suppresses all errors — queries fail silently. PDO::ERRMODE_WARNING triggers PHP warnings. PDO::ERRMODE_EXCEPTION throws PDOException on any database error, enabling try/catch and preventing silent data corruption. Always set ERRMODE_EXCEPTION. PDOException extends RuntimeException and exposes errorInfo() with the SQLSTATE code, driver error code, and driver message.

How It's Exploited

Common Misconception

Why It Matters

Common Mistakes

• Forgetting to set ERRMODE_EXCEPTION — silent failures corrupt data without any visible error.
• Catching PDOException and swallowing it with an empty catch block.
• Logging the exception message but not the SQLSTATE or full errorInfo array, losing diagnostic detail.

Avoid When

• Never expose PDOException messages directly in HTTP responses — they contain table names, column names, and query structure.

When To Use

• Always set ERRMODE_EXCEPTION immediately after constructing the PDO object.
• Catch PDOException at the service layer, log the full error, and rethrow as a domain exception.

Code Examples

// ERRMODE_SILENT — default — fails invisibly
$pdo = new PDO($dsn, $user, $pass);
$stmt = $pdo->prepare('INSERT INTO orders VALUES (?, ?)');
$stmt->execute([$userId, $total]); // returns false silently on error
// $total was never saved — you'll never know

$pdo = new PDO($dsn, $user, $pass, [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
]);

try {
    $stmt = $pdo->prepare('INSERT INTO orders (user_id, total) VALUES (?, ?)');
    $stmt->execute([$userId, $total]);
} catch (PDOException $e) {
    // Log full error detail — never expose to user
    error_log('DB error: ' . $e->getMessage() . ' SQLSTATE:' . $e->getCode());
    throw new RuntimeException('Order could not be saved', 0, $e);
}

References

• ↗ https://www.php.net/manual/en/pdo.error-handling.php

Tags

Related Terms