display_errors turned on in code
Why it matters
Error messages shown to visitors expose file paths, SQL queries and sometimes credentials.
ini_set('display_errors', '1');ini_set('display_errors', '0');
ini_set('log_errors', '1');
ini_set('error_log', '/var/log/php/app.log');How to fix
Show errors only in development. In production log them with log_errors instead.
Scan my code
Scan my code β
Paste a file and PHP Safe points to every line that matches this rule.