Is upload_max_filesize for one single file or for multiple files?
For example, if the property is set to upload_max_filesize: 5M, is it possible to upload three single files which are 2 MB each (for a total of 6MB)? Or will that not work because upload_max_filesize is set to 5MB?
I've been doing some tests but I would like to know the community's perspective.
Use post_max_size to set the total and upload_max_filesize for max per file.
Check: https://www.php.net/manual/en/ini.core.php#ini.upload-max-filesize
upload_max_filesize int - The maximum size of an uploaded file. When an int is used, the value is measured in bytes. Shorthand notation, as described in this FAQ, may also be used.
And https://www.php.net/manual/en/ini.core.php#ini.post-max-size
post_max_size int - Sets max size of post data allowed. This setting also affects file upload. To upload large files, this value must be larger than upload_max_filesize. Generally speaking, memory_limit should be larger than post_max_size. When an int is used, the value is measured in bytes. Shorthand notation, as described in this FAQ, may also be used. If the size of post data is greater than post_max_size, the $_POST and $_FILES superglobals are empty. This can be tracked in various ways, e.g. by passing the $_GET variable to the script processing the data, i.e. <form action="edit.php?processed=1">, and then checking if $_GET['processed'] is set.
I can confirm that upload_max_filesize is the maximum size per file.
e.g. with upload_max_filesize=2M, you can upload 3 files of 1.5M.
I just confirmed this by testing.
Limits you should care about:
upload_max_filesize (default 2M): max size per individual file;
max_file_uploads (default 20): max number of files you can send per request;
post_max_size (default 8M): max raw POST data size per request;
post_max_size must be greater than the sum of the sizes of:
all uploaded files
all data in other POST fields
a few extra KB to account for the multipart/form-data overhead (headers/boundaries) that wrap every single file and every single POST field in the payload.
Be really careful with these limits, as PHP will not error if you exceed one of them; instead, you'll end up with partial or empty $_POST or $_FILES and might have a hard time debugging the issue.
For example, max_file_uploads will silently ignore any file past the nth uploaded file, and you'll end up with a truncated list of files with no warning whatsoever.
Related
This question already has answers here:
PHP post_max_size vs upload_max_filesize, what is the difference?
(2 answers)
Closed last month.
Im actually confused both upload_max_size and post_max_size.
I searched on the google. but all the results show about how to increase size. but my question is what is post_max_size.
Post_max_size
Sets max size of post data allowed. This setting also affects file upload. To upload large files, this value must be larger than upload_max_filesize.
Generally speaking, memory_limit should be larger than post_max_size. When an int is used, the value is measured in bytes. Shorthand notation, as described in this FAQ, may also be used. If the size of post data is greater than post_max_size, the $_POST and $_FILES superglobals are empty.
This can be tracked in various ways, e.g. by passing the $_GET variable to the script processing the data, i.e. , and then checking if $_GET['processed'] is set.
Just literately from PHP.net
According to official PHP manual:
Sets max size of post data allowed. This setting also affects file
upload. To upload large files, this value must be larger than
upload_max_filesize. Generally speaking, memory_limit should be larger
than post_max_size. When an int is used, the value is measured in
bytes. Shorthand notation, as described in this FAQ, may also be used.
If the size of post data is greater than post_max_size, the $_POST and
$_FILES superglobals are empty. This can be tracked in various ways,
e.g. by passing the $_GET variable to the script processing the data,
i.e. , and then checking if
$_GET['processed'] is set.
https://www.php.net/manual/en/ini.core.php#ini.post-max-size
I'm working on creating a photo upload form and I'm running into some trouble. Essentially, a user fills out some basic demographic data, checks a media release, selects a photo, and uploads it. I then use a few nested if statements to validate that it's the correct photo size, type, etc.
At times it works just fine, but with certain photos I've been getting this error:
PHP Warning: POST Content-Length of 11310075 bytes exceeds the limit
of 8388608 bytes
Followed by a bunch of
PHP: Notice: Undefined Index
for each of elements in my $_POST array. I did some digging with phpinfo() and found that memory_limit is set to 128M...so I'm confused as to what's going wrong.
I'm using MODX, Apache/2.2.25
Thanks for your help!
The issue is not about memory, but max upload/post data limit. Please check you phpinfo() for:
post_max_size
upload_max_filesize
These values should be increased. This can be done by editing php.ini file, or by set_ini() function.
You can set unlimited memory usage with this code.
ini_set('memory_limit', '-1');
I'm getting some variables with $_POST, mainly inputted by the user on a form.
To prevent huge values to be inserted in the form, I can check those variables and return an error to the user if they're to long.
However, I can't do that if the user input a REALLY long value because, in this case, the entire script crash before I can even refuse to process that variable. Is this a threat to the security of my server?
How can I fix this without increasing the default memory limit? Is it possible?
Restraining user input with a javascript could be an option, but the user may easily overcome that limit by disabling javascript.
You can limit the maximum size of a post body using the ini directive post_max_size. However its defaults to 8M. If it is unchanged it should be ok as the default memory_limit is 128M. (php 5.3)
But of course this depends on what you are about to do with the data and how much memory PHP will consume for this. In extreme speak, it would be even possible to create an example script that reaches the memory limit with a 1 byte input. So you'll have to find the proper value for your application.
From the documentation
Sets max size of post data allowed. This setting also affects file upload. To upload large files, this value must be larger than upload_max_filesize. If memory limit is enabled by your configure script, memory_limit also affects file uploading. Generally speaking, memory_limit should be larger than post_max_size. When an integer is used, the value is measured in bytes. Shorthand notation, as described in this FAQ, may also be used. If the size of post data is greater than post_max_size, the $_POST and $_FILES superglobals are empty. This can be tracked in various ways, e.g. by passing the $_GET variable to the script processing the data, i.e. , and then checking if $_GET['processed'] is set.
Do you have access to php.ini? You can set upload_max_filesize / post_max_size
See here for details: http://php.net/manual/en/ini.core.php#ini.sect.file-uploads
(p.s. setting maxlength in the HTML form is easily circumvented by a malicious user)
Divides the data on the client into parts and download in parts via Ajax, then save the downloaded part on the disc or in the database. Maybe this way?
I read http://www.php.net/manual/en/ini.core.php#ini.post-max-size.
memory_limit must > post_max_size . Then if user upload a file 500MB then how much total RAM use ?
does it use >500MB ?
No, memory_limit need not be greater than post_max_size.
PHP has different POST readers and handlers depending on the content type of the request. In case of "multipart/form-data" (what is used for sending files), rfc1867_post_handler acts as a mixed reader/handler. It populates both $_POST and $_FILES. What goes into $_POST counts towards the memory limit, what goes into $_FILES also counts.
However, $_FILES has just meta-data about the files, not the files themselves. Those are just written into the disk and hence don't count towards the memory limit.
What is the ideal limit for posting the data through the form.
There is an 8 Mb max size for the POST method, by default (can be changed by setting the post_max_size in the php.ini file).