In my table I have created an index on 'col1' to prevent duplicate entries which works well but the resulting error message displayed to a user when they attempt to add a duplicate entry seems to to me be a security concern as it displays the SQL including the table prefix.

Is there any way to stop Joomla from displaying the SQL in the error message?

I've tried changing the error reporting settings in the global config but it has no effect as far as I can tell...

Example message:


Save failed with the following error: Duplicate entry 'Test' for key 'TestKey' SQL=INSERT INTO `jml_mycomp_tbl1` (`id`,`col1`,`ordering`,`state`,`created_by`) VALUES ('0','Test','2','1','730')

  • 1
    I'm new to Joomla, but you are absolutely right, any userland errors in a production environment should not contain any SQL. Not just for security, but because it is meaningless to users and gives a bad user experience. In a production environment, display_errors (PHP setting) should be off and such errors should only be logged to your server-side error log.
    – MrWhite
    Commented May 13, 2014 at 23:22
  • Just curious, you've probably already checked this but you dont happen to have any debug settings enabled do you? Check: Global Config > debug system setting. Check: Global Config > Error reporting level. Check: Plugins > Debug plugin Just curious if you have anything strange going on. I ask because I was reading this learn.theartofjoomla.com/developing-extensions/… Commented May 14, 2014 at 2:18
  • @ChadWindnagle Hi Chad, yes I tried turning that on off but no effect...
    – doovers
    Commented May 14, 2014 at 2:19
  • sorry just edited, can you just let me know you saw the updated contents? thnx! Commented May 14, 2014 at 2:20
  • @ChadWindnagle No I hadn't seen your edit! I did try error reporting but I forgot about disabling plugin (thanks for the tip) which I just tried now but still no effect!
    – doovers
    Commented May 14, 2014 at 2:27

3 Answers 3


Maybe you can use a try catch command:

//Your code to run the SQL here 
catch (Exception $e)
$this->setError('The error message you want');
return false;
  • Thanks for the suggestion but since I was using JTable the best solution was to override the check method as in my answer.
    – doovers
    Commented May 14, 2014 at 8:39
  • This is good answer Commented Nov 5, 2015 at 3:29

Since it doesn't appear to be possible to prevent this behaviour, I implemented the following solution. Add a duplicate check to a JTable check method override:

// Check for duplicate entry
$db = JFactory::getDbo();
$query = $db->getQuery(true);

$query->where($db->quoteName('col1') . ' = ' . $db->quote($this->col1));

$result = $db->loadResult();

if ($result) 
    $this->setError(" Duplicate entry for col1 = '" . $this->col1 . "'");
    return false;            

You should change your code that makes the insert to firstly check for duplicate and return a proper error (one that you write) to the user and not rely on showing the actual error returned by MySQL.

  • Yeah I thought I might have to do that but I'm still concerned that Joomla is happy to show the SQL in an error message displayed to the user. Surely this is a security concern?? I thought the whole point of the random table prefix is as a security measure no? Maybe best practice is to do your own error handling but there may be situation that you cannot foresee... Just seems a bit strange to me!
    – doovers
    Commented May 13, 2014 at 23:08
  • Well, Joomla! doesn't show the SQL error message to the user, your code does.
    – Ivo
    Commented May 13, 2014 at 23:20
  • I disagree, my code does not show the error message but allows the Joomla core code to show it. In my opinion, the core code should not display the table prefix in any circumstance as it is a security concern...
    – doovers
    Commented May 13, 2014 at 23:29
  • Why don't you use INSERT IGNORE instead of INSERT?
    – Ivo
    Commented May 14, 2014 at 0:10
  • Good suggestion and I could do that but since I am using JTable I would be more inclined to override the check method and test for a duplicate there. I want to display an error message to the user, just not with the SQL in it!
    – doovers
    Commented May 14, 2014 at 0:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.