in reply to [untitled node, ID 182637]

In my experience, it's generally not a good idea to leave FatalsToBrowser enabled in production code. There's a lot of discussion of this elsewhere in the monastery, and so I'll not delve into that. I'll also not ask you why are you putting code in a production environment with errors such as that ;)

My lecturing aside. . . check the CPAN documentation for CGI::Carp. There's an excellent example of creating your own error message featured there. I'll repeat it here, however it's no substitute for reading the actualy documentation: 

use CGI::Carp qw(fatalsToBrowser set_message);
BEGIN {
   sub handle_errors {
      my $msg = shift;
      print "<h1>Oh gosh</h1>";
      print "<p>Got an error: $msg</p>";
  }
  set_message(\&handle_errors);
}

[download]
In a production environment, I remove FatalsToBrowser and instead replace it with custom error handling (and don't let the code go out with compile errors ;) Statements I've known to fail from time to time (database calls, etc.) I instead wrap in an eval block: 
eval
{
  $sql = $dbh_receipt->prepare_cached($script);
  $sql->execute();
  $sql->bind_columns(\$receipt);
  $sql->fetch();
  $sql->finish();
};

if($@)
{
  log_error($dbh_receipt->err(),
            $dbh_receipt->errstr(),
            $script);
}

[download]
By processing my own errors, I control exactly what the user sees, and can then log them to a database and even e-mail them to myself so I can look like a good guy to my users when I fix their problems before they have a chance to call me about them.

Granted, this might be overkill for what you are trying to do, and I've probably strayed too far OT from the original question, but you get the point ;)

Hope this helps!
MrCromeDome

Replies are listed 'Best First'.
182652
by Samn (Monk) on Jul 17, 2002 at 23:55 UTC
    		[reply]

        You say you don't listen, but I want you to listen because maybe you don't care what happens to you, but I don't want your carelessness to affect me! I'm dead serious about that. Maybe the data is backed up and isn't sensitive. That's still a computer you have there and it's obviously hooked up to the net. If a cracker sees this, he or she is going to know that you don't care about security and I'm willing to bet that you have plenty of other security holes on this box. Now, here's a quote from a friend of mine that I've included in my CGI course:

        [A friend] found I had been running the server for a few months, and asked what kind of security I was running. I chuckled and told him there was no need, since the computer had no valuable information on it.

        He gave me a funny look, and he started port-scanning my machine. As you would expect, just about everything was open. As we looked further and further in to it, things starting looking bad. There was evidence that someone else had been in my system.

        The clincher came when we found a SQL server database of news groups on my server. Chances are I was used to spam these news groups.

        The person quoted above was apparently used to spam newsgroups. That's pretty annoying. It would have been more annoying to find out that his box was a slave participating in DDOS attacks.

        I strongly urge you to read through my course. It's not the best you'll find, but it's fairly decent and it will give you some background information that you need. I don't mean to sound harsh, but this is pretty serious and I don't want to kid around about it.

        I'm sick of klez.

        I'm sick of DDOS attacks.

        I'm sick of Sub Seven.

        I'm sick of all of those irritating and costly security issues caused by people thinking "the data's backed up and isn't sensitive so I don't need to worry about security". At the very least, if you truly believe that there's nothing wrong with your point of view, please don't advertise it. A lot of animals are silent in the jungle for a very good reason.

        Cheers,
        Ovid

        Join the Perlmonks Setiathome Group or just click on the the link and check out our stats.

    		[reply]

    In Section Seekers of Perl Wisdom