It wasn't my post, but the reason is simple. The hook in
question will make errors go to the browser in a fairly
informative fashion. This aids development. But if someone
is trying to attack your site, the debugging output will
help them break in.
It is kind of like leaving a note saying where the key is
hidden.
That said, the actual style given there of having lines of
code you modify between development and production is not
the way you should do it. Instead what you should do is
have a very small module that has those lines. Install that
module in your development environment. Then in your
production environment have a different version of the
module that doesn't do anything. That way you don't have
to touch your code going from development to production,
and nothing will mess up. Otherwise your development
process will be constantly complicated by the need to
track down things like those lines which have to be edited
at the last moment before going live, lines which you
could introduce errors on. This will be an ongoing source
of work and problems.
Many here will recognize this as an example of an
abstraction layer. Instead of writing in development
hooks through your code, you write an abstraction layer
for turning on the optional hooks. That abstraction
layer will do the right thing for your evironment without
your having to change a lot of source code going from one
environment to another. The idea of solving problems with
abstraction layers rather than scattered checks is a key
one in good programming. I talk about it a bit at
RE (tilly) 2: Handling cascading defaults (abstraction is great!) among other places. |