Do Not Use Error Suppression

ID

php.do_not_use_error_suppression

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Php

Tags

error-handling, reliability

Description

Reports any use of the PHP error-suppression operator @, for example @file_get_contents($path) or @$arr['key']. The operator silently discards every diagnostic the prefixed expression would otherwise emit.

Rationale

Prefixing an expression with @ turns off error reporting for that expression: warnings, notices and recoverable errors are thrown away instead of being logged. The program then continues with whatever (often wrong) value the failing call produced, so a missing file, an undefined array key or a failed network call passes completely unnoticed. This makes defects far harder to find and is one of the slowest constructs in the engine because the runtime still has to build and then drop the error.

<?php
$data = @file_get_contents($path);   // FLAW — a read failure is hidden, $data is false
$value = @$arr['key'];               // FLAW — an undefined key is silently ignored

if (is_readable($path)) {            // OK — the condition is checked explicitly
    $data = file_get_contents($path);
}
$value = $arr['key'] ?? null;        // OK — the null-coalescing operator handles the miss

Remediation

Remove the @ and handle the condition the operator was masking: guard the call (is_readable, file_exists, isset), use the null-coalescing operator ?? for possibly missing array keys, or check the return value and react to a failure. When a library only signals failure through warnings, convert them with a dedicated error handler instead of suppressing them.

References