title: Are detailed exception/error messages a security risk?
body: <p>I currently check every GET and POST variable with <code>isset()</code> and throw exceptions when <code>isset()</code> returns false.</p>
  
  <p><strong>Example 1:</strong></p>
  
  <pre><code>if(!isset($_GET['some_var']))
      throw new Exception('GET variable [some_var] is not set.');
  
  $someVar = $_GET['some_var'];
  </code></pre>
  
  <p><strong>Example 2:</strong></p>
  
  <pre><code>if(!isset($_GET['some_num']))
      throw new Exception('GET variable [some_num] is not set.');
  
  if(!ctype_digit($_GET['some_num']))
      throw new Exception('GET variable [some_num] is not a number.');
  
  $someNum = $_GET['some_num'];
  </code></pre>
  
  <p>In my production application I have a global exception handler that posts exceptions and errors to a log file and then redirects to a generic apology page.</p>
  
  <p>Is this an okay practice? Are descriptive exception and error messages such as the ones above security risks (is it possible that a hacker would be able to read the exception notice and then use that information to manipulate my scripts)?</p>
  
  <p>Thanks!</p>