Fix Improper Error Handling in CodeIgniter

Improper error handling in CodeIgniter frameworks often leads to Information Exposure through verbose stack traces and database error messages. In a production environment, leaking internal file paths, SQL query structures, or environment variables is a high-severity risk that aids attackers in mapping the attack surface. Hardening requires a transition from 'development' reporting to a 'production' posture where errors are logged silently and users receive generic responses.

The Vulnerable Pattern

// index.php
define('ENVIRONMENT', 'development');
// In a Controller
public function getUser($id) {
try {
$user = $this->db->query(“SELECT * FROM users WHERE id = $id”)->getResult();
} catch (\Exception $e) {
// CRITICAL: Leaking raw exception message to the client
die($e->getMessage());
}
}

The Secure Implementation

The vulnerability lies in the 'development' environment setting which forces 'display_errors' to 1. The secure implementation does three things: 1) Sets ENVIRONMENT to 'production' to suppress global error output. 2) Uses a generic 'show_error' call to prevent leaking schema details via SQL exceptions. 3) Implements server-side logging using 'log_message', ensuring that forensic data is stored in the logs directory (with 0600 permissions) rather than being transmitted over the wire to a potential adversary.

// index.php
define('ENVIRONMENT', 'production');
// application/config/config.php (CI3) or .env (CI4)
// CI_ENVIRONMENT = production
// In a Controller
public function getUser($id) {
try {
$user = $this->db->query(“SELECT * FROM users WHERE id = ?”, [$id])->getResult();
} catch (\Throwable $e) {
// Log the actual error for the dev team
log_message(‘error’, ‘[SEC-TRACE] Database error: ’ . $e->getMessage());
    // Return a generic error view to the user
    show_error('An internal server error occurred.', 500);
}
}