Why should a web application avoid revealing detailed database errors to users?

### Why this is right The material warns that default database errors can reveal valuable information, including table and field names. An attacker can use such details to understand the database structure and refine attempts against the application. ### The concept Error handling is an information-disclosure control. Applications should avoid exposing internal details to ordinary users while still allowing appropriate operational troubleshooting through controlled channels. ### The other options - **B. Detailed errors automatically encrypt all database records.**: Error messages do not encrypt stored information. - **C. Error messages prevent all password theft.**: Error handling does not stop every route to credential theft. - **D. A database cannot function unless all errors are hidden from its administrators.**: The material concerns avoiding disclosure to attackers, not eliminating diagnostic information for authorized administrators. ### Terms - **Information disclosure**: Exposure of data that should not be available to a recipient. - **Database error**: A message reporting a problem in a database operation. ### Remember Give users safe error messages, and keep useful diagnostic detail under controlled access.