Re: [PHP] security question of ZCE exam

2009-08-25 Thread Daniel Brown
On Tue, Aug 25, 2009 at 00:07, Augusto Flavio wrote: > > Answers: (choose 2) >    Error messages will contain sensitive session information >    Error messages can contain cross site scripting attacks >    Security risks involved in logging are handled by PHP > X    Error messages give the percepti

[PHP] security question of ZCE exam

2009-08-24 Thread Augusto Flavio
Hi all, i'm discutting with my friend about this question for 30 min and i do not agree with he. Here is the question: Why is it important from a security perspective to never display PHP error messages directly to the end user, yet always log them? Answers: (choose 2) Error messages wil