Security and throwing an Exception

Question

Hi all.

I wrote a function that gets the balance from PayPal. To connect properly I'm passing the user, password and certificate as parameters. Every thing looks ok until something throws an Exception inside and php prints all the parameters (user details in this case) on the stacktrace. I'm logging everything to a file so users wouldn't be able to see it anyway but I'd really like to know how to hide sensitive information from the stacktrace. To be true, I don't even like the idea of having it printing out passwords to log files...

Thanks for your time and help :)

Cheers, Diogo

Answer 1

If it's php that is throwing an exception, can't you catch it within a try/catch block ?

Answer 2

Catch the exception, then handle it rationally without exposing the information. For example, you could log the fact that there was a PayPal exception and display a message along those lines to the user, but without showing the exception string itself.