← CodeClarityLab Home
Browse by Category
+ added · updated 7d
← Back to glossary

PHP Error Levels & error_reporting

php OWASP A5:2021 PHP 5.0+ Intermediate

Also Known As

PHP error reporting E_ALL E_NOTICE error_reporting()

TL;DR

PHP's graduated error severity system from E_NOTICE to E_ERROR, controlled by error_reporting and display_errors INI directives.

Explanation

PHP errors span multiple levels: E_ERROR (fatal, stops execution), E_WARNING (non-fatal runtime), E_NOTICE (minor runtime hints), E_DEPRECATED, E_STRICT (coding standards), E_PARSE (compile-time syntax), and the aggregate E_ALL. error_reporting = E_ALL is the correct development setting — it surfaces E_NOTICE and E_DEPRECATED issues that become real bugs. display_errors must be Off in production (log instead). set_error_handler() registers a custom handler to convert errors to exceptions or structured log entries. PHP 8.0 promotes many warnings to TypeErrors, making strict typing even more valuable.

Common Misconception

Setting error_reporting(0) in production is a valid security measure. Hiding errors does not prevent them — it makes debugging nearly impossible and can mask security-relevant failures. Log errors to a file with display_errors=Off and log_errors=On instead.

Why It Matters

PHP's error level bitmask controls which errors are reported and logged — running production with E_ALL hidden masks bugs; running development without E_DEPRECATED misses upgrade-breaking changes.

Common Mistakes

  • Setting error_reporting = 0 in development — hides all errors and makes debugging impossible.
  • Not enabling E_DEPRECATED — deprecated function calls are silent until the version that removes them.
  • Using display_errors = On in production — leaks file paths, stack traces, and database structure to users.
  • Not converting errors to exceptions with set_error_handler() — errors and exceptions get handled inconsistently.

Code Examples

✗ Vulnerable
# php.ini — production with errors displayed:
error_reporting = E_ALL
display_errors = On   ; Never in production — use log_errors = On instead
log_errors = Off      ; Errors not logged — invisible failures
✓ Fixed
; php.ini — development: show everything
error_reporting = E_ALL
display_errors = On
log_errors = On

; php.ini — production: log, never display
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
display_errors = Off
log_errors = On
error_log = /var/log/php/error.log

// PHP — set at runtime (overrides php.ini)
error_reporting(E_ALL);
set_error_handler(function(int $errno, string $errstr, string $file, int $line): bool {
    if (!(error_reporting() & $errno)) return false; // respect @ operator
    throw new \ErrorException($errstr, 0, $errno, $file, $line);
});

// Convert all errors to exceptions — makes them catchable and loggable

Added 15 Mar 2026
Edited 22 Mar 2026
Views 33
Rate this term
No ratings yet
🤖 AI Guestbook educational data only
| |
Last 30 days
0 pings F 0 pings S 0 pings S 0 pings M 0 pings T 0 pings W 1 ping T 0 pings F 0 pings S 3 pings S 0 pings M 0 pings T 0 pings W 0 pings T 0 pings F 1 ping S 1 ping S 0 pings M 0 pings T 0 pings W 0 pings T 0 pings F 1 ping S 1 ping S 0 pings M 0 pings T 1 ping W 0 pings T 0 pings F 1 ping S
No pings yesterday
Perplexity 10 Amazonbot 8 Unknown AI 3 Ahrefs 2 Google 2 SEMrush 2 ChatGPT 1
crawler 26 crawler_json 1 pre-tracking 1
DEV INTEL Tools & Severity
🟡 Medium ⚙ Fix effort: Low
⚡ Quick Fix
Set error_reporting(E_ALL) in development to see every notice and deprecation — these are bugs waiting to become errors in the next PHP version
📦 Applies To
PHP 5.0+ web cli
🔗 Prerequisites
🔍 Detection Hints
error_reporting(0) or E_ERROR only suppressing notices warnings; @ error suppression operator in code
Auto-detectable: ✓ Yes phpstan phpcs semgrep
⚠ Related Problems
🤖 AI Agent
Confidence: High False Positives: Low ✓ Auto-fixable Fix: Low Context: File

✓ schema.org compliant