Can't change display_errors value

Question

I can't turn off display errors for my website. I use ISP Manager control panel. It is Off in all php.ini files and settings. But still warnings and notices are showing. Even using ini_set() right in the script doesn't work. Can you help me with this?

<?php

ini_set('display_errors', 0);
phpinfo(); // display_errors is still On On

ini_get('display_errors'); // returns 'stderr'

Answer 1

In our case it was issued by the PHP FPM configuration. Some values were pinned with php_admin_flag or php_admin_value, so it was not possible to set them at runtime with ini_set().

From the php-fpm documentation:

It's possible to pass additional environment variables and update PHP settings of a certain pool. To do this, you need to add the following options to the pool configuration file.

Example #1 Passing environment variables and PHP settings to a pool

php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com
php_flag[display_errors] = off
php_admin_value[error_log] = /var/log/fpm-php.www.log
php_admin_flag[log_errors] = on
php_admin_value[memory_limit] = 32M

PHP settings passed with php_value or php_flag will overwrite their previous value. Please note that defining disable_functions or disable_classes will not overwrite previously defined php.ini values, but will append the new value instead.

Settings defined with php_admin_value and php_admin_flag cannot be overridden with ini_set().

See also PHP-FPM-Configuration

Answer 2

If I understood correctly, something like:

var_dump(ini_set('display_errors', 0));

… produces:

bool(false)

I can think of two ways to intentionally prevent display_errors from being changed:

1. Disabling ini_set() altogether in system-wide INI file, which produces different symptoms:

   Warning: ini_set() has been disabled for security reasons
   NULL
   

   This can be checked anyway:

   var_dump(ini_get('disable_functions'));
   

2. Hard-coding display_errors in Apache settings using php_admin_flag, which only applies if PHP runs as Apache module but effectively produces a boolean false.

I believe we're in #2. You may want to check whether PHP runs as Apache module; I'm not aware though of any way to verify by yourself if php_admin_flag is being used. If that's the case, I reckon you're out of luck:

php_admin_flag name on|off

Used to set a boolean configuration directive. This can not be used in .htaccess files. Any directive type set with php_admin_flag can not be overridden by .htaccess or ini_set().

If you're in control of Apache settings this is something you can easily fix. Otherwise, I suggest you ask hosting support about this. IMHO, it isn't reasonable to enable display_errors in a production server, let alone force it:

; This directive controls whether or not and where PHP will output errors,
; notices and warnings too. Error output is very useful during development, but
; it could be very dangerous in production environments. Depending on the code
; which is triggering the error, sensitive information could potentially leak
; out of your application such as database usernames and passwords or worse.
; For production environments, we recommend logging errors rather than
; sending them to STDOUT.
; Possible Values:
; Off = Do not display any errors
; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)
; On or stdout = Display errors to STDOUT
; Default Value: On
; Development Value: On
; Production Value: Off
; http://php.net/display-errors

Answer 3

Overview

There are a few different types of error reporting function in PHP. Luckily we have a decent explanation of these in the PHP docs here.

I typically use the three in the examples below. Let's walk through those.

Breakdown Docs

This function sets the error reporting level.

error_reporting()

The error_reporting() function sets the error_reporting directive at runtime. PHP has many levels of errors, using this function sets that level for the duration (runtime) of your script. If the optional level is not set, error_reporting() will just return the current error reporting level.

This first function takes a parameter of an integer or a named constant. The named constant is recommended in case future version of PHP release new error levels. That way you will always know what to expect after upgrading to a newer version of PHP.

This next mode decides if errors will be printed to the screen or not.

ini_set('display_errors', 1)

This determines whether errors should be printed to the screen as part of the output or if they should be hidden from the user.

The last one handles errors that happen during PHP's startup sequence. When you turn display_errors on it does not handle errors that occur in the startup sequence. This is partially the reason why a lot of times people do not understand why they are not seeing errors even though they have turned error reporting on.

Even when display_errors is on, errors that occur during PHP's startup sequence are not displayed. It's strongly recommended to keep display_startup_errors off, except for debugging.

This will tell the app to log errors to the server.

ini_set('log_errors', 1);

Tells whether script error messages should be logged to the server's error log or error_log. This option is thus server-specific.

Example

To turn off error reporting in a file try this,

ini_set('display_errors', 0);
ini_set('display_startup_errors', 0);
error_reporting(0);

To turn on error reporting in a file try this,

ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

Answer

If you want to log errors but do not want them to show up on the screen then you would need to do this,

ini_set('display_errors', 0); ini_set('display_startup_errors', 0); error_reporting(E_ALL);

Or try,

ini_set('display_errors', 0); ini_set('display_startup_errors', 0); ini_set("log_errors", 1); error_reporting(E_ALL);