I'm currently writing a PHP script that 3rd party clients will be able to access using GET. It will take a few GET parameters and return an XML document with results.
My question is, if required GET parameters are left out or contain invalid data how should display errors back to the end user?
Should I return a completely different XML document with the error details or the same XML document with errors in the existing fields or just put the errors as HTML?
How is the content requested? Do some users surf to the page? Or is another PHP script requesting those details? If it's a PHP script requesting the XML, I would just output HTTP 400 Bad Request. If it's a human being browsing to the site, I think a friendly error page would be fine if the parameters are crucial.
For example, if they are requesting for
xml.php?file=report1584.xml
but they did not supply the file parameter, you would simply tell them that there was an error, no file was specified.