Najgori dan developera je kad sajt pukne u produkciji, a u logu piše "Whoops, something went wrong". Bez stack trace-a, bez context-a, bez ničega. Ovo je vodič kako pravilno postaviti error handling i debugging u PHP-u — tako da znaš što puklo, ali da ne izložiš sigurnost javnosti.
PHP error config — osnove
Tri kritične PHP postavke (u php.ini ili .user.ini):
display_errors— pokazuje errore u browseru. UVIJEK Off u produkciji. Otkrivanje stack trace-a krajnjem korisniku = security info disclosure.log_errors— piše errore u log fajl. UVIJEK On.error_log— gdje (cesta do fajla).error_reporting— koje errore prijavljivat.E_ALL & ~E_DEPRECATED & ~E_STRICTza production.
Tipičan production setup:
display_errors = Off
log_errors = On
error_log = /home/USER/logs/php_error.log
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICTLocal development — Xdebug
Xdebug = PHP ekstenzija za debugging. Tri glavna mode-a:
- debug — step debugger (breakpoint, step over, inspect vars). Sa IDE-om (PhpStorm, VS Code) najmoćniji tool.
- profile — generira cachegrind fajl, vidi koja funkcija jede vrijeme. Analyse u KCachegrind, Webgrind ili PhpStorm.
- trace — log svake function call, parametara, return.
Setup:
pecl install xdebug
# u php.ini:
zend_extension=xdebug.so
xdebug.mode=debug
xdebug.start_with_request=trigger
xdebug.client_host=host.docker.internal # ako u Docker-uNIKAD ne pokreći Xdebug u produkciji — 2-5x slower performance, sigurnosni risk.
Whoops — friendlier error pages
Default PHP error message je groozan. Whoops je pretty-printed error page s syntax highlighting, stack frame inspection, request data.
Laravel ga ima built-in (samo u APP_DEBUG=true mode). WordPress treba plugin (npr. Debug Bar).
NIKAD u produkciji — pokazuje source code i environment vars.
Laravel debugging tools
Telescope (oficijelni)
Web dashboard za sve što se događa u app-u: requesti, queries, jobs, mailovi, exceptions, gates, models, redis commands, schedule runs.
composer require laravel/telescope --dev
php artisan telescope:install
php artisan migratePristupi na /telescope. Disable u produkciji ili zaštiti gate-om (samo admin emails).
Debugbar
Sticky bar na dnu svake stranice s queries, timings, exceptions.
composer require barryvdh/laravel-debugbar --devAuto-disable kad APP_DEBUG=false.
Ray (Spatie)
Desktop app + Composer paket. ray($var) u kodu → output u Ray desktop appu, real-time.
Plus: dump na drugi ekran, ne ometa output. Filtrirat po request, query, model.
Cijena: 59 USD jednokratno.
Pail (Laravel native)
Live tail log fajla iz CLI.
php artisan pailFilter po log level, channel.
WordPress debugging
WP_DEBUG constants
U wp-config.php:
define('WP_DEBUG', true);
define('WP_DEBUG_LOG', true); // log u wp-content/debug.log
define('WP_DEBUG_DISPLAY', false); // ne pokazuj na ekranu
define('SCRIPT_DEBUG', true); // ne minified JS/CSS
define('SAVEQUERIES', true); // log svake DB query (memory heavy)U production: WP_DEBUG = false ili WP_DEBUG = true + WP_DEBUG_DISPLAY = false.
Query Monitor plugin
Najbolji WP debug plugin. Pokazuje: DB queries, slow queries, hooks fired, conditional tags, HTTP requesti, scripts/styles loaded, environment.
Toolbar u admin baru ili na frontend-u (samo za admin).
Debug Bar + Debug Bar Console
Sličan Query Monitor, ali ima i live PHP console.
WP-CLI za debugging
wp option get siteurl
wp post get 123
wp eval 'var_dump(get_post(123));'
wp db query "SELECT * FROM wp_options WHERE option_name LIKE '%cache%'"Error reporting → centralized service
Sentry (vidi prošli post o monitoring-u) — sve uncaught exceptions automatski idu na Sentry. Laravel i WP setup je 5 min.
Custom logger u kodu:
// Laravel
log()->error('Something broke', ['user' => $user->id, 'order' => $orderId]);
// WordPress
error_log('My error: ' . print_r($data, true));Production debugging bez breaking stuff
Klijent javi "sajt mi je čudan" u produkciji. Što sad, bez Xdebug-a?
1. Reproduciraj na staging
Imaš staging environment (vidi staging post)? Tamo enable Xdebug, debugbar, Query Monitor i reproduciraj.
2. Tail log fajl real-time
tail -f /home/USER/logs/php_error.log
tail -f wp-content/debug.log
php artisan pailTriggeruj akciju u browseru, vidi što piše.
3. Limit debug na specifičan user/IP
// wp-config.php
if ($_SERVER['REMOTE_ADDR'] === 'TVOJ.IP.ADDR.OVDJE') {
define('WP_DEBUG', true);
define('WP_DEBUG_DISPLAY', true);
}Samo tvoj IP vidi errore, ostali ne.
4. Strategic logging
Dodaj error_log('CHECKPOINT 1');, error_log('CHECKPOINT 2: ' . print_r($var, true)); kroz kod, deploy, prati log, ukloni kad ne treba.
5. Laravel Telescope ograničen na admin
// TelescopeServiceProvider
Gate::define('viewTelescope', function ($user) {
return in_array($user->email, ['admin@yourdomain.com']);
});Sigurnosni pitfalls
- display_errors=On u produkciji — pokazuje database credentials, paths, internal structure. Veliki security leak.
- phpinfo() na public URL-u — često se zaboravi obrisat
info.phpnakon testing-a. Otkrije sve module, paths, config. - Debug toolbar visible to all — Telescope, Debugbar accesibilni public-u. Postavi gate.
- Verbose error u API response — sanitiziraj prije slanja klijentu, log full u backend.
- Sentry sa PII — koristi
beforeSendhook da scrub-aš sensitive data prije slanja. - Production .env exposed — provjeri da nije accessibilan preko URL-a (nginx/Apache blok za .env).
Practical debug workflow
- Reproduciraj na local/staging prvo.
- Xdebug step debugger ako ti je dostupno.
- Telescope/Query Monitor za query patterns i slowness.
- Sentry za production errors, breadcrumbs, user context.
- Log tail real-time tijekom user-reportiranog bug-a.
- Strategic error_log dodaj-deploy-prati-ukloni za production-only bugs.
- Postmortem: dokumentiraj root cause + fix + prevention.
Performance debugging
- Xdebug profile mode + KCachegrind za function-level breakdown.
- Blackfire production-safe profiler, periodically samples.
- Tideways APM s timeline view.
- MySQL slow query log + EXPLAIN za DB bottleneck.
- Query Monitor za WP DB queries po request-u.
WMD i debugging support
WMD postavlja PHP error logging na svakom hosting accountu po default — error_log fajl rotiraju automatski, klijent ima pristup kroz cPanel File Manager. Za WordPress klijente Query Monitor instaliran u Maintenance Plan-u (admin-only). Za Laravel klijente Telescope + Pail setup uključen, pre-configured da je samo admin-accessible. Sentry integracija za critical errors uključena u Pro Maintenance Plan. Pomažemo s production debugging-om — log analiza, slow query optimization, profiler analiza kroz Super brzu podršku.
FAQ
display_errors mi je On i sajt radi — što je problem? Bilo koja exception je vidljiva napadaču: SQL credentials, file paths, stack frames. Gasi odmah.
Treba li Xdebug u CI/CD? Samo za code coverage report (Xdebug ima coverage mode). Za testing ne treba.
Telescope mi puni bazu — što sad? Postavi php artisan telescope:prune --hours=24 kao cron. Reduce TELESCOPE_RESPONSE_SIZE_LIMIT.
Mogu li imati Xdebug i Blackfire istovremeno? Tehnički da, ali ne. Sukobljavaju se, biraj jedan.
Ray ili dump()? Ray je premium, ne ometa output (radi u zasebnom appu). dump()/dd() su besplatni ali blokiraju response (dd kill-a request). Za serious debug Ray vrijedi.
Trebaš pomoć s debugging-om production problema? WMD Super brza podrška uključuje log analizu, slow query review, error tracking setup. Javi se preko kontakt forme.
