SecurityInnovation/TeamMentor-PHP — Issue #39: SQL Errors Messages Are Not Disclosed
Author: SergeTruth
Created: 2011-11-09 13:43:52+00:00
State: open

"cmysql_error() isn't a function in the PHP, mysql_error() is, additionally, should be expanded to include common databases, and database abstraction layers by default:

Abstraction layers:
DBA uses php's built in error handler.
PDO: throws a PDOException
odbc: odbc_error() and odbc_errormsg()

DB Specific
Postgres: pg_last_error(), pg_result_error_field(), pg_result_error()
SQLite3: SQLite3::lastErrorCode, SQLite3::lastErrorMsg
SQLite: sqlite_error_string(), sqlite_last_error()
SQLSRV: sqlsrv_errors()
mssql: mssql_get_last_message()
mysqli: mysqli_connect_errno(), mysqli_connect_error(), mysqli_errno(), mysqli_error(), $mysqli->connect_errno, $mysqli->connect_error, $myssqli->errno, $mysqli->error
mysql: mysql_error(), mysql_errno()
Additional Information: http://us.php.net/manual/en/refs.database.php
Related Items: Do Not Include Debugging Data in Output
Use a Global Exception Handler for Unhandled Exceptions

"