title: PDO error handling
body: <p>From a tutorial on the intertubes I learned a bit about doing PDO queries. The tutorial used try/catch and the queries are basically structured like so:</p>
  
  <pre><code>try {
      $dbh = new PDO("mysql:host=$hostname;dbname=$dbname", $user, $pass);
  
      $dbh-&gt;setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
      $dbh-&gt;setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
  
      $stmt = $dbh-&gt;prepare("UPDATE users yada yada yadda");
  
      $stmt-&gt;bindParam(':param1', $param1, PDO::PARAM_INT);
      $stmt-&gt;bindParam(':param2', $param2, PDO::PARAM_INT);
  
      $stmt-&gt;execute();
  
  }
  
  catch(PDOException $e)
  {
      echo $e-&gt;getMessage();
  }
  </code></pre>
  
  <p>This of course echos mysql errors on the screen. Not that I intend on having bad queries, but I do not like the idea of echoing out errors right on the screen, figuring what if an attacker tries to induce said errors and try to learn something from them.  </p>
  
  <p>Is there a better way to do this so that any errors go to a log file instead, or do I in actuality have nothing to fear in this regard since the bound parameters eliminate the risk of any sql injection?</p>