...

Do we prefer using trigger_error() or the direct PMA_Message::display variant?

Generally anything what comes as an error from PHP needs to be escaped, so there are two options:

• pass our error messages to trigger_error as some object (let's call

it SafeString for now) and if error handler sees SafeString, it won't  do any processing of that

• do not use trigger_error for anything what includes markup

I'd prefer first solution (actually marking strings as safe to output is generally useful thing to prevent XSS).

The concept would be great—but trigger_error only accepts strings. See the signature here:

bool trigger_error ( string $error_msg [, int $error_type = E_USER_NOTICE ] )

I suggest a workaround. We might store the message’s MD5 hash in a global variable, like this:

function whitelist_error($errstr) { if (!isset($GLOBALS['error_whitelist'])) { $GLOBALS['error_whitelist'] = array(); } $GLOBALS['error_whitelist'][] = md5($the_message); }

Within the PMA_Error_Handler::handleError function, we would check if the current $errstr is whitelisted:

// if error message is not whitelisted, sanitize it if (! isset($GLOBALS['error_whitelist']) || ! in_array(md5($errstr), $GLOBALS['error_whitelist'])) {

$errstr = htmlspecialchars($errstr); } $error = new PMA_Error($errno, $errstr, $errfile, $errline);

But looking at this, do we still prefer trigger_error over directly echoing PMA_Error objects as with The phpMyAdmin configuration storage is not completely configured in main.php line 322?