PHP: [Bug] Why does "display_errors" exist if only "error_reporting" can hide or show errors?

Question

EDIT: My Environment is the following (this is relevant to the answer):

• Microsoft IIS 10.0 Express
• Windows 7 Professional SP1
• PHP Version 5.6.16 x86 FastCGI

I am trying to figure out what purpose the setting "display_errors" has. In the following code, I am attempting to hide the PHP Notice that is thrown at line 9. Naturally one would think that simply setting

 display_errors = 'Off'

would accomplish this, but it seems to have no effect.

I am of the understanding that "error_reporting" lets you choose which errors are caught, and "display_errors" determines whether or not the error messages are echoed to the user. Am I mistaken? In most of my Google searches, I see people setting both

error_reporting = 0

and

display_errors = 'Off'

But, why even bother with

   display_errors = 'Off'

when it does not have an effect anyway?

My test code:

<?php
//ini_set("error_reporting", 0);
ini_set("display_errors", "Off");
ini_set("display_startup_errors", "Off");
date_default_timezone_set("America/Chicago");

echo "Hey<br />";

echo $myarr["hey"];

When I run this code, I see the following error message (this is a link to the image, since I don't have enough reputation to post it here):

https://i.stack.imgur.com/qB6Au.png

PHP: The error message generated for line 9 should be hidden from the user. Why does "display_errors" exist if it does nothing?

Answer 1

After trial and error and using ShiraNai7's explanations I have found that this is a bug in PHP on Microsoft IIS and FastCGI. See link to bug:

Bug #44729 display_errors = Off not respected

https://bugs.php.net/bug.php?id=44729

Answer 2

Yes, PHP errors and their configuration may seem a bit really weird if one isn't familiar with the inner workings. There is a lot going on.

display_errors

• controls whether PHP's default error handler prints errors to the output as they happen
  • error codes suppresed by error_reporting will not printed
• controls whether PHP's default exception handler prints uncaught exceptions to the output

log_errors

• controls whether PHP's default error handler logs errors to error_log
  • error codes suppresed by error_reporting will not be logged
• controls whether PHP's default exception handler logs exceptions to error_log

error_reporting

• defines a global mask for errors that should be reported
• this option is used by the PHP's default error handler (see above)
• this option should be used by the custom error handler too

set_error_handler()

• defines a custom error handler
• it is always called if an error occurs (even if its suppressed)
• if it returns false, the PHP's default error handler WILL be called (and print / log errors according to the settings)
• if it returns null or true or throws an exception, the PHP's default error handler WILL NOT be called (and thus it won't print / log anything).

set_exception_handler()

• defines a custom exception handler
• PHP's default exception handler will not be called if a custom handler is defined (and thus it won't print / log anything)

---

But, why even bother with "display_errors = 'Off'" when it does not have an effect anyway?

There are combinations of the above settings that make display_errors not useless.

Examples:

• display_errors must be off in php.ini on production servers to prevent leaking of possibly sensitive data
  • an error / exception can happen before you have the chance to change any of the other settings
• if you want to log errors but not print them to the output, you set display_errors to off and log_errors to on
• if you are using a custom error handler that prints custom error messages but you also want to use error_log, you set display_errors to off