PHP Logging And Exceptions

Logging

Do not hide domain-relevant logging in helper methods such as getXOrWarn(...).

Log where the problem is detected so the log points to the real origin.

Log Safety Review

Before finalizing logging changes:

• Keep log calls where the failure or skip decision is made.
• Extract collaborators only for formatting, encoding, mapping, or classification, not to hide domain-relevant logging.
• Treat external data, exception values, validation paths, and rejected values as unsafe before logging.
• Encode unsafe log values at the last formatting boundary before they are passed to the logger.
• Do not pass raw dynamic values into logger placeholders or concatenated log messages when the value may come from requests, persisted data, external systems, files, config, generated URLs, S3 keys, exception messages, or validation failures. Validate inputs at the boundary where feasible, but also encode unsafe log values at the final logging boundary with a project-approved encode...ForLog helper. Keep the original value for domain, storage, and API behavior; only encode the value passed to the logger. Keep exceptions unencoded and pass them through the logger's established exception mechanism.
• When adding a reusable log encoder, cover CR, LF, CRLF, tabs, quotes, and script-like payloads in focused unit tests.
• Name extracted log-formatting methods with verb phrases such as format..., encode..., or create....