Hide or Show Sanitized PHP Errors in QCDR

PHP Tokens default to Hide PHP errors — Recommended. In that mode, QCDR logs a safe diagnostic and preserves authored content when the PHP fails instead of exposing the PHP error to frontend visitors. Show sanitized PHP errors — Advanced is available for controlled troubleshooting.

Show mode is intentionally not a production default. The diagnostic can appear in rendered frontend output, so use it only while testing and return the Token to Hide afterward.

Hide PHP Errors

With Hide selected, a thrown PHP error or an unsuppressed runtime warning makes the PHP Token unresolved. QCDR suppresses the diagnostic from visitor output and logs a safe warning.

For a standalone Token, the original {token.name} placeholder remains. For a Rule replacement, the original matched text remains. If another Token or direct replacement depends on the failed PHP Token, QCDR can fail that whole dependent value rather than applying partial output.

Show Sanitized PHP Errors

Show mode inserts a QCDR diagnostic where the Token would render. A thrown error produces a sanitized error marker. A runtime warning produces a sanitized warning marker before any captured output that followed the warning.

The visible diagnostic is HTML-escaped. QCDR does not append stack traces, PHP source, temporary filenames, or line/file metadata, and it strips recognizable absolute filesystem paths. Its safe-message handling also redacts common secret-like assignments such as passwords, authorization values, cookies, tokens, and license keys.

Sanitized Does Not Mean Private

A sanitized PHP message can still reveal application-specific wording, class/function behavior, record identifiers, or other context that you would not normally show to visitors. Use Show only on a controlled test route or during a short troubleshooting window.

Warnings and Errors Behave Differently

A caught throwable/error stops that PHP execution. In Show mode, QCDR returns the sanitized error diagnostic. A PHP warning/notice captured by QCDR can allow execution to finish; Show mode prepends the sanitized warning to the captured output. Hide mode treats that warning as a failed resolution and preserves the original authored content.

Warnings explicitly suppressed by PHP's @ operator are respected by QCDR's runtime handler and are not promoted into the Token's warning state.

How to Troubleshoot Safely

  1. Narrow the Token to a controlled frontend page and user context.
  2. Change PHP errors in output to Show sanitized PHP errors — Advanced.
  3. Load the exact page and capture the sanitized message.
  4. Check Joomla/QCDR logs for the corresponding safe warning.
  5. Correct the PHP and retest.
  6. Return the Token to Hide PHP errors — Recommended.

Failures That May Not Produce a Show Marker

Some operational failures—such as inability to create/write the temporary execution file or output exceeding QCDR's configured processing-size ceiling—fail closed as unresolved output. Treat preserved authored content plus QCDR log warnings as part of the diagnostic picture even when no frontend marker appears.

Community Discussion

Want to compare workflows, share practical tips, or discuss how you use this QCDR feature? Visit the QC Dynamic Replacer Community. For private support, bug reports, account-specific issues, or feature requests, use the QuantaCade support system.