Prevent error message from showing SQL

Question

In my table I have created an index on 'col1' to prevent duplicate entries which works well but the resulting error message displayed to a user when they attempt to add a duplicate entry seems to to me be a security concern as it displays the SQL including the table prefix.

Is there any way to stop Joomla from displaying the SQL in the error message?

I've tried changing the error reporting settings in the global config but it has no effect as far as I can tell...

Example message:

Error

Save failed with the following error: Duplicate entry 'Test' for key 'TestKey' SQL=INSERT INTO `jml_mycomp_tbl1` (`id`,`col1`,`ordering`,`state`,`created_by`) VALUES ('0','Test','2','1','730')

Answer 1

Maybe you can use a try catch command:

try
{
//Your code to run the SQL here 
}
catch (Exception $e)
{
$this->setError('The error message you want');
return false;
}

Answer 2

Since it doesn't appear to be possible to prevent this behaviour, I implemented the following solution. Add a duplicate check to a JTable check method override:

// Check for duplicate entry
$db = JFactory::getDbo();
$query = $db->getQuery(true);

$query->select('COUNT(*)');
$query->from($this->get('_tbl'));
$query->where($db->quoteName('col1') . ' = ' . $db->quote($this->col1));

$db->setQuery($query);
$result = $db->loadResult();

if ($result) 
{
    $this->setError(" Duplicate entry for col1 = '" . $this->col1 . "'");
    return false;            
}

Answer 3

You should change your code that makes the insert to firstly check for duplicate and return a proper error (one that you write) to the user and not rely on showing the actual error returned by MySQL.