An exception is an object that signals a failure outside the normal path of program execution. A PHP function can throw an exception; a caller can use try and catch to handle a known failure, while finally supplies cleanup or bookkeeping during ordinary control-flow unwinding. OSPHP.006 introduces the underlying mechanisms and applies them to a small, fully tested input-validation exercise.

The prior OSPHP.005: Functions established typed arguments, returns, and local scope. The arrays lesson established collections and iteration. PHP exceptions connect those foundations to deliberate failure handling: instead of returning a fabricated numeric value after invalid input, a function can state why normal processing cannot continue.

Learning objectives and prerequisites

• Distinguish a thrown Exception from an Error and from an ordinary diagnostic warning.
• Write throw, try, catch, and finally statements in PHP 8.
• Explain matching catch types, multiple catch clauses, and union catches.
• Use specific standard exception classes for input validation and domain constraints.
• Predict how exceptions propagate through functions, and explain why a global handler cannot resume execution.
• Apply defensive input validation to invented wattage readings without implying real equipment measurements.
• Run the complete PHP CLI lab, interpret its output, and reproduce 30 automated checks.
• Handle failure without revealing credentials, stack traces, or raw sensitive inputs to users.

Prerequisites: PHP syntax, conditionals, arrays, loops and functions; a local PHP CLI and terminal are helpful. Review OSPHP.001: PHP Runtime and OSPHP.003: Variables where needed. The complete example was tested with PHP 8.4.24 CLI; it uses only PHP’s built-in standard facilities and requires no external packages, database, web server or administrator privileges.

Throwing an exception changes the execution path

A PHP exception object carries a class, message, optional numeric code, and trace information. When a function executes throw, the remaining statements on that path are skipped. PHP searches the call stack for a compatible catch; if no catch matches, the exception remains unhandled and the script normally terminates or reaches a registered global exception handler. The official PHP exceptions manual defines the behavior.

<?php
declare(strict_types=1);

function divide(int $numerator, int $denominator): float {
    if ($denominator === 0) {
        throw new InvalidArgumentException('Denominator cannot be zero.');
    }
    return $numerator / $denominator;
}

try {
    echo divide(12, 3) . PHP_EOL; // 4
    echo divide(12, 0) . PHP_EOL;
    echo "Unreachable after throw" . PHP_EOL;
} catch (InvalidArgumentException $e) {
    echo 'Invalid input' . PHP_EOL;
}
// Output:
// 4
// Invalid input

A caught exception does not retroactively run code that was skipped. Execution continues after the handling construct unless the handler throws again, exits, or otherwise changes control flow. A deliberately specific exception class tells the caller which sort of failure it should expect, avoiding ambiguous return values such as -1 or 0 when those might be legitimate results.

Understanding PHP’s two throwable families

Throwable is the interface implemented by both Exception and Error. Standard classes such as InvalidArgumentException, DomainException, and RuntimeException extend Exception. Type mismatches may raise TypeError, which extends Error. A catch (Exception $e) does not catch every TypeError. By contrast, catch (Throwable $e) catches both families, although indiscriminately treating programming errors as recoverable can hide defects.

Consult the PHP error-handling overview and standard exception hierarchy. PHP diagnostics such as notices and warnings use another reporting mechanism: they do not automatically become catchable Exception objects. An application may install an error handler to convert selected diagnostics into ErrorException, but many critical startup and compile-time failures cannot be converted that way.

Program With Gio, “PHP Error Handling & Error Handlers — Full PHP 8 Tutorial”, February 1, 2021. Source: the creator’s public YouTube lesson. Explains diagnostic categories and handlers before the more advanced exception tutorial. Video identity checked; actual embedded playback has not been independently tested.

Catching only failures a program can handle

A catch declaration matches the first compatible exception class. More specific catches should come before broader handlers. Since PHP 7.1, a union catch can use | to handle related exception classes with the same response. PHP 8 also permits omitting the caught variable when its details are unnecessary.

try {
    $watts = parseWattReading($text, 1000.0);
} catch (InvalidArgumentException | DomainException $e) {
    // Show a safe public message, not raw exception internals.
    echo "Reading rejected." . PHP_EOL;
}

The lesson’s parseWattReading() function is a controlled example. It rejects malformed numeric text with InvalidArgumentException and values beyond an invented training limit with DomainException. No industrial setpoint, miner power rating, or approved facility operating limit is implied. The validation policy accepts nonnegative decimal strings with at most two fractional digits; scientific notation, commas, negative signs, and leading zeroes are rejected intentionally.

Finally executes during ordinary exception unwinding

A finally block is useful for releasing temporary resources, recording an attempt, or restoring state whether the protected operation succeeds or throws. In normal exception control flow, PHP executes finally after the try or matching catch and before execution resumes. A sudden process termination, machine failure, or forced kill should not be treated as a guaranteed opportunity for cleanup.

$events = [];
try {
    $events[] = 'try';
    throw new RuntimeException('Teaching example');
} catch (RuntimeException $e) {
    $events[] = 'catch';
} finally {
    $events[] = 'finally';
}

echo implode(' > ', $events);
// try > catch > finally

Do not return a replacement value from finally as a general pattern. A return there can override a return computed earlier, and a new exception thrown inside finally may replace the propagated exception. The official exception documentation explains those interactions. Production cleanup should be designed around the actual resource lifetime and failure semantics, not around an assumption that every error leaves time for recovery.

Complete wattage-input exercise

The standalone ExceptionLab.php file contains parseWattReading(), summarizeReadings() and illustrateFinally(). A simple training array contains '120', '35.50', 'oops', '1200', and '0'. The upper limit is an invented 1,000 W per reading. The lab accepts three values and rejects two, then reports a total of 155.50 W from accepted values. The numbers are fabricated input examples, not data-center measurements.

function parseWattReading(string $raw, float $upperLimit = 1000.0): float {
    if (!is_finite($upperLimit) || $upperLimit <= 0.0) {
        throw new InvalidArgumentException('The limit must be positive.');
    }
    $text = trim($raw);
    if (strlen($text) > 24 ||
        preg_match('/\A(?:0|[1-9][0-9]*)(?:\.[0-9]{1,2})?\z/D', $text) !== 1) {
        throw new InvalidArgumentException('Invalid decimal input.');
    }
    $watts = (float) $text;
    if (!is_finite($watts) || $watts > $upperLimit) {
        throw new DomainException('Outside example range.');
    }
    return $watts;
}

Input format and policy must be defined before validation. The code avoids blindly applying (float) to arbitrary text; many strings would otherwise convert to misleading numbers. It also bounds the length of accepted strings, checks for finite numeric results, and validates the example limit. The complete repository version additionally caps batches at 10,000 entries and checks the resulting aggregate for a finite value. PHP strlen counts bytes, which is suitable for the deliberately ASCII-only numeric format.

The iterator uses a union catch for expected invalid measurements and increments the processed counter in finally. A TypeError from passing a non-string item is intentionally not swallowed. An invalid configured limit is rejected before the per-reading loop, so a configuration defect cannot masquerade as multiple bad readings.

foreach ($rawReadings as $raw) {
    try {
        $value = parseWattReading($raw, $upperLimit);
        $accepted++;
        $total += $value;
    } catch (InvalidArgumentException | DomainException $e) {
        $rejected++;
    } finally {
        $processed++;
    }
}

The complete runnable source includes an array of accepted/rejected decisions and a finally demonstration for success and failure. The small excerpt above illustrates the central idea; use the linked complete file for reproducible execution rather than combining excerpts into a new script with missing variables.

Running and testing the exercise

Download ExceptionLab.php and ExceptionLabTest.php into the same local directory. Use PHP 8.4 or another compatible PHP 8 release. No database or network service is needed. From the directory containing both files, execute:

php -v
php -l ExceptionLab.php
php -l ExceptionLabTest.php
php ExceptionLab.php
php ExceptionLabTest.php

The preparation environment used PHP 8.4.24 CLI. Both lint commands reported no syntax errors. The recorded exercise output was:

Accepted: 3
Rejected: 2
Processed: 5
Total watts (illustrative): 155.50
Finally on success: try > success > finally
Finally on failure: try > catch > finally
PASS: 30 checks

The independent test harness uses 30 assertions covering integer and decimal inputs, whitespace, zero, boundaries, invalid characters, non-finite limits, overflow-domain rejection, batch counts, decision ordering, empty input, incorrect types, a batch-length cap, and normal/error finally behavior. All 30 of 30 checks passed locally. Those checks establish observed behavior for the supplied cases, not formal proof of completeness, API safety, or production reliability.

Program With Gio, “OOP Error Handling in PHP — Exceptions & Try Catch Finally Blocks”, June 4, 2021. Source: the creator’s public YouTube tutorial. Discusses throwing at 01:15, catches at 07:15, finally at 11:21, and global handlers at 14:12. Video identity checked; independent embedded playback remains unverified.

Propagating, logging, and safely presenting errors

When an exception cannot be handled at the current layer, allowing it to propagate—or wrapping it with a more specific exception while preserving the previous cause—can be safer than returning made-up success data. The constructor for standard Exception accepts a previous throwable, retrievable with getPrevious(). Reserve detailed traces, file paths, SQL statements, and secrets for secure development diagnostics. A public HTTP response should generally expose a safe status message and an appropriate status code without internals.

try {
    throw new InvalidArgumentException('Bad training input');
} catch (InvalidArgumentException $previous) {
    throw new RuntimeException('Input processing failed', 0, $previous);
}
// At an appropriate outer boundary, handle the RuntimeException.
// $e->getPrevious() identifies the original cause.

A global handler installed with set_exception_handler() can log an uncaught throwable and return a controlled failure response, but ordinary execution does not resume afterward. A diagnostic handler installed with set_error_handler() is different. In a production web environment, display detailed errors only in a protected development context, keep display_errors disabled for public users, and configure protected logging. See PHP’s global exception handler and error reporting configuration.

Troubleshooting, risk, and engineering boundaries

• Uncaught throwable terminates the script: inspect the originating stack trace in a secure development environment, identify the proper handling boundary, and avoid blanket catch-and-ignore.
• Exception catch does not intercept a TypeError: TypeError belongs to the Error family; repair the caller, rather than quietly classifying all programming defects as user input problems.
• Warnings still appear: many diagnostics are reported through error_reporting and an error handler, not automatically through catch.
• Accidental data disclosure: avoid echoing $e->getMessage() or traces to public users when those may contain sensitive details.
• Configuration error treated as bad row: validate configuration before entering a batch-level try/catch loop.
• Unbounded memory or CPU use: place explicit limits on input size, batch length, and retry behavior. Exception handling alone does not protect against resource exhaustion.
• Incorrect engineering inference: the example’s watt values do not imply measured instantaneous load, device specifications, or energy use over time.

Real systems should distinguish telemetry validation from equipment safety controls. A parsing exception is not an electrical interlock. Safe operational design may require independent hardware protections, protected logs, retry caps, and verifiable configuration management.

Exercises and assessment

• Change the training limit from 1,000 W to 200 W. Predict which of the five entries pass, then confirm with the code.
• Add a new reading '4.75'; determine the new accepted count and total.
• Explain why TypeError may propagate through catch (InvalidArgumentException | DomainException).
• Remove the finally block from a disposable copy; identify the counter that will stop increasing for rejected inputs.
• Use one catch for two related exception classes and a separate handler for a different recoverable class. Explain matching order.
• Demonstrate the difference between a warning reported by the engine and an intentionally thrown Exception.
• Write a short rule for deciding whether an error should be caught locally, propagated, or handled at the application boundary.
• Explain why a successful test suite is not evidence that malformed external inputs are handled in every possible case.

Answer key: under a 200 W limit the same three numeric entries (120, 35.50 and 0) remain accepted, because 1,200 W was already rejected; adding 4.75 raises the sum from 155.50 to 160.25 W and the accepted count from three to four. TypeError is an Error, not one of the caught exception subclasses. Without finally the processed count in the example would not be updated for rejected rows unless moved to another safe location. Broad handlers must come after specific ones. Successful test results apply only to the tested inputs.

Verified references and curriculum continuation

Technical references: PHP Manual — Exceptions, Error Handling, Standard Exception Classes, InvalidArgumentException, set_exception_handler(), and set_error_handler(). For related curriculum, review OSHTML.004 — Forms and OSJavaScript.005 — Control Flow.

Deliberate error handling separates normal results from failed operations. PHP’s exception mechanism supports precise failure reporting, typed handling, propagation, and cleanup during normal unwinding. Validated numeric inputs and tested exception boundaries are transferable techniques for backend APIs, data pipelines, and monitoring software.

Editor’s Note: OSPHP.006 follows OSPHP.005 in the verified Open CERT / TechCert rotation. The 1200 × 630 featured image is original AI-generated educational art, not a photograph of an operating system or an actual live software capture; the small bottom-left neon-green “Bitcoinversus.Tech” signature is applied to the cover. All wattage inputs and thresholds are fabricated teaching values. The PHP 8.4.24 CLI example passed syntax checks and 30 locally executed assertions. The two externally sourced educational video identities were verified, but actual playback and pixel-level mobile inspection of the final published page were not independently tested.

For mobile scanning, display the original QR on a second screen or use a compatible wallet’s saved-image scanning feature. Confirm the destination address and 5,000-satoshi amount inside your wallet before authorizing payment.

We volunteer daily to ensure the information on this platform is Verifiably True. If you would like to support the research, please scan the QR code.

BitcoinVersus.Tech educational lessons do not replace engineering validation, formal safety procedures, secure deployment review, or applicable regulatory requirements.