Re: Re: CGI Error Handling

[davorg]

in reply to Re: CGI Error Handling
in thread CGI Error Handling

Whilst this is great to use when you're developing a script, I wouldn't advise using it in production code. This is because the error messages that it gives can be a source of useful information for anyone trying to crack your site. In some cases, just knowing that you've got Perl installed on you server can give crackers a head start.

Error messages like this belong in the server error log where the webmaster can read them. There's a good reason why Apache gives a plain 500 error page by default.

--
<http://www.dave.org.uk>

"The first rule of Perl club is you do not talk about Perl club."
-- Chip Salzenberg

[Fastolfe]

It almost sounds like you're warning people away from using CGI::Carp entirely. (You probably aren't, but I wanted to post this for the benefit of other readers that might also be confused.) It's mainly the fatalsToBrowser and warningsToBrowser bits that we don't want to see in production code. CGI::Carp's primary purpose is to format out nice, debug-friendly error messages in your server's error logs, so I definitely recommend its use even in production code.