3.5 Detecting PHP Errors

The program func.php uses the @ operator to suppress some PHP errors. Instead of using the scream extension to track down application failures, which would require you to rebuild PHP and restart the web servers, you can use the error probe to report all PHP errors, including any suppressed errors. The following D program, detphperr.d, shows an example of how to use the error probe.

Example 3.5 detphperr.d: Detect errors in PHP programs

#!/usr/sbin/dtrace -qs

/* detphperr.d -- Detect errors in PHP programs */

php*:::error
{
    printf("PHP error\n");
    printf("  error message             %s\n", copyinstr(arg0));
    printf("  request file              %s\n", copyinstr(arg1));
    printf("  line number               %d\n\n", (int)arg2);
}

detphperr.d outputs a summary of any error that occurs in the PHP programs that are running on the system, for example:

# ./detphperr.d
PHP error
  error message             fopen(/tmp/foo.bar): failed to open stream: No such file or directory
  request file              /var/www/html/ex2.php
  line number               76

PHP error
  error message             Call to undefined function foo()
  request file              /var/www/html/ex3.php
  line number               69

PHP error
  error message             Division by zero
  request file              /var/www/html/ex1.php
  line number               66
...

You can use a program such as detphperr.d to report errors that might indicate incorrectly queries or attempted SQL injection attacks, for example:

# ./detphperr.d
...
PHP error
  error message             You have an error in your SQL syntax; check the manual that
                            corresponds to your MySQL server version for the right syntax
                            to use near 'drop table table1; --'' at line 1[select * from
                            table1 where n like 'B%';drop table table1; --']
  request file              /var/www/html/ex4.php
  line number               61
...