SecurityInnovation/TeamMentor-PHP — Issue #1: Prevent Disclosure of SQL Errors
Author: SergeTruth
Created: 2011-11-09 13:29:29+00:00
State: open

"cmysql_error() isn't a function in the PHP, mysql_error() is. Additionally, should be expanded to include common databases, and database abstraction layers by default:
Abstraction layers:
DBA: uses php's built in error handler.
PDO: throws a PDOException
odbc: odbc_error() and odbc_errormsg()
DB Specific:
Postgres: pg_last_error(), pg_result_error_field(), pg_result_error()
SQLite3: SQLite3::lastErrorCode, SQLite3::lastErrorMsg
SQLite: sqlite_error_string(), sqlite_last_error()
SQLSRV: sqlsrv_errors()
mssql: mssql_get_last_message()
mysqli: mysqli_connect_errno(), mysqli_connect_error(), mysqli_errno(), mysqli_error(), $mysqli->connect_errno, $mysqli->connect_error, $myssqli->errno, $mysqli->error mysql: mysql_error(), mysql_errno()

Additional Information: http://us.php.net/manual/en/refs.database.php
Related Items: Do Not Include Debugging Data in Output Use a Global Exception Handler for Unhandled Exceptions"