tags:

views:

48

answers:

1

Hi,

really quick question

please look at the following example

$dbConnect = mysql_connect($host , $username , $password) or die ("BIT OF A PROBLEM PLEASE COME BACK LATER");

is this a good way to do it or should I maybe use

$dbConnect = mysql_connect($host , $username , $password);
    if(!$dbConnect)
    {
        echo "COULD NOT CONNECT !!";
    }
    else
    {
        echo "CONNECTED !!";
    }

If you could explain which way is best it would be a great help too.

also to add I have error_reporting(0); set

thanks

+3  A: 

The second is 2000-times more preferable to the first. In the first method all the user will see is a blank page with the text "BIT OF A PROBLEM..." - not very user friendly.

With the second method you could do whatever you like, such as send an automated e-mail to support staff while re-directing users to a nicely presented error page telling them you've been notified of the problem and working on it etc. If you have a second server you could also try connecting to that one as well before giving up completely.

Andy Shellam
So as security issue there is no better or worse way to do that.
Oliver Bayes-Shelton
As far as security goes, neither way is better or worse, it's purely cosmetic. Remember to set display_errors to OFF in your php.ini, otherwise if mysql_connect does fail, PHP will plaster your connection details in a "warning" message across the browser - NOT what you want!
Andy Shellam
On the other hand, if there is nothing meaningful that the app can do if connection fails, dying is practical and secure.
bugspy.net
@bugspy.net - it depends on the app's purpose. If it's put in front of users, I would never use die(). Actually I'd never use it anyway, and always redirect to another page. That way if someone inadvertently switches display_errors back on, there's less chance of it leaking info.
Andy Shellam