I got a file upload form using enctype=multipart/form-data, but my $_FILES array is always empty. max_upload_size is big enough (2MB, I'm testing with 100kb files). the exactly same code is working on other hosts, so I think something is wrong with my webhoster's php settings. does anyone know what I could check for? when I ask them they always tell me it can't be their fault -_-
EDIT:
You asked for code, I didn't post it because it's pretty complicated (a Shopware plugin), but I think I can extract the important parts:
HTML (Smarty):
<form method="post" action="{url action=saveRegister}" enctype="multipart/form-data">
PHP (inside my event handler):
file_put_contents('ul.log',serialize($_FILES));
Result (var_dumped unserialized):
array(0) {}
Full Form HTML: http://pastebin.com/Wq1yBTux
Found the error: some "security feature" of the framework "cleaned up" $_POST, so move_uploaded_file couldn't check if the file was uploaded correctly
Install Firebug (see network tab) or Livehttpheaders to see if your file is actually sent to the server and if the HTTP headers are correctly send by the browser.
They might be wrong for any reason (Content-Type not allowed, POST method not allowed)
It should give you data to look at and configuration parameters to check.
Related
I'm trying to upload a file to my server or just open it and handle the contents but I get this strange error and I don't know why.
HTML form: http://pastebin.com/cSfMmvKF
php script: http://pastebin.com/fPzRVy5Y
If I try to test if the file is received I get a false response. Example:
if (isset($_FILES['epifile']))
echo 'Is set';
This evaluates as false. I'm pretty sure everything is quite correct so I have no idea where the error comes from. Can you guys help?
Edit: I'm running this with XAMPP on my own PC. Could it be some setting that I need to enable within Apache?
Your form must have an enctype="multipart/form-data" attribute.
Currently when user uploads a photo the page says "Warning: POST Content-Length of XXX bytes exceeds the limit of 21000000 bytes in Unknown on line 0".
I know what that means and I am NOT looking for the solultions like the increasing the max_upload values or even memory_size_limit... Because users may and users will upload terabytes of nonsense even if you explicitly tell them only max 20MB files and only images are allowed.
I am looking for a solution on:
How to prevent this warning(s) to even happen?
OR at least:
How to prevent displaying of this warning(s)?
EDIT: PLEASE READ ! - Please understand that of course I am handling the error/warning after (since line 1) , problem is this happens on a virtual "line 0" that is why I need to hide the error or prevent it to raise - because I cant put any code before the place where the error happens.
EDIT2: Finally after a very long research and digging I got an idea - it worked - see my own answer.
So after searching instead of working today I finally got an idea how to solve this, it worked, and even didnt cause much damage. But please first understand what you are doing, before doing it. :) As I suggested in one of my comments it is really possible to turn off PHP errors in .htacess - just turn off the PHP startup warnings.
Before you apply the solution:
Note that: after you insert this code to your .htaccess you won't be able to see any
startup error
Also note that: there are more start up errors on line "0" than this one.
Do before: Before you do this you should prepare your script in the way that it should check the uploaded content size and give user a proper information message. The fact that the warning doesnt show DOES NOT mean that you should do nothing about it. It means the EXACT oposite - you should do all that you can to make something at least near-equal to the warning raise - check, double check if you can, handle error and raise your own error message.
Add this to your .htaccess:
php_flag display_startup_errors off
It is not that evil as it seems to be:
Please note that this turns off startup errors only.
So all the regular PHP errors/warnings/notices stays ON :)
Even XAMPP's PHP "itself" recommends it for production:
The php.ini file literaly says:
; display_startup_errors
; Default Value: Off
; Development Value: On
; Production Value: Off
PS: "startup error" seems to be those errors before PHP script is executed itself - these errors are usually trying to "persuade" you that they are on the line 0.
Thanks to my idea and this answer: How to disable notice and warning in PHP within .htaccess file?
EDIT: As this is a php_flag setting, you can of course also set it by default in your php.ini if you have custom instalation of PHP :)
The question is
How to prevent Warning: POST Content-Length
the answer is, without edit any config value, put this code at the very start of the file that will receive the form to be processed:
<?php // here start your php file
ob_get_contents();
ob_end_clean();
That is. No more warning, as well anything else you do not want as output on your page.
After, as suggested elsewhere you can decide what to do with:
if($_SERVER['REQUEST_METHOD'] == 'POST' && empty($_POST) && empty($_FILES) && $_SERVER['CONTENT_LENGTH'] > 0){ echo"WoW your file is too big!"; }
Maybe also chunk the file, if in another way you pass correct values about file to be processed by Php.
as explained here Warning: POST Content-Lenght ...
I've got a similar problem to you, and wondered if you'd found a satisfactory solution. Currently, my 'PHP Warning: POST Content-Length of 21010354 bytes exceeds the limit of 8388608' is in the log, and I don't think there is much I can do about it.
I've working within a Zend framework, and when a user uploads a file as above, it basically kills all the usual POST data parsing, so the response to getParams() contains none of the usual POST parameters. This means the users is getting a validation error, saying one of the fields is missing, which is misleading.
In researching this, I've found a few interesting php_ini settings you might want to look at, notably enable_post_data_reading and always_populate_raw_post_data. In my case, I'm uploading a 20M file, with a 8M post max and a 10M uploaded file max, and the result from php://input seems to be a full on 20M file, even though the post data is now empty.
So I'm going to manually check if the raw data exceeds the limit, and assume everything failed if it did (and bail). I suggest you could write your own code to parse the raw data, to populate the $_POST data. Then you can startup your code, as you wish, and only when you're ready, check if the user has uploaded more data than the limit. It's down to you, to then return an error before parsing it, or if it's ok, to parse it. As long as you set the PHP post and upload limits, to above your user limit, it should allow the user to break the rules, allowing your code to detect the breech and complain about it.
Here is the REAL solution to prevent this error properly.
Set this parameters in your php.ini :
enable_post_data_reading = On
upload_max_size=0
post_max_size=0
Warning : be sure to have this line in your form
<input type="hidden" name="MAX_FILE_SIZE" value="2048576" />
AND the MOST IMPORTANT :
be sure to check the code errors of $_FILES['file']['error']
be sure to check size of your upload in PHP too
As you have already found out for yourself, it is impossible to do it in PHP, since PHP can only catch errors from line 1 onwards.
The only way around would be to dig in the PHP source code, find where that error is thrown and remove that part from PHP sources before compiling your costume php version.
But be warned that the error message is thrown for a reason.
To Prevent this error to happen you have to check the size of the uploaded files before and in case they're to big you have to cancel the upload!
To just not show them i think it should be enough if you write in your php script
error_reporting(0);
1.You can check the file size before uploading in JavaScript but this can be tampered !
2.Check the file size after uploaded and before saving the file.
<?php
$size = filesize($uploaded_file);
if($size > $your_size_limit)
{
echo "Throw bunch of errors";
}
else
{
//save it
}
?>
3.Don't try to hide the errors to solve the problem.
I'm coding an website which must have same functionality as SO. My server use Litespeed, which increase the speed of runing php files.
When I'm trying to send php code in regular form, everything seems to be ok, data being sent to the action file without interpreting the code inside the variable. But when I'm trying to send the same data in comments textareas, with jQuery $.post method, I'm getting Forbidden 403 error. Data is blocked on the road by Litespeed server. I don't know why is happening this, why is $_POST data auto-evaluated when using ajax?
This situation doesn't appear everytime, but just in some cases, for example:
this is a new message which presents this php code: <?php mysql_query("SELECT * FROM my_table"); ?>
Note that if I remove <?php and ?> from my message, it is ok. I've already tried to use encodeURI() method but this don't change anything.
Is there any setting which must be applied in .htaccess for not auto-evaluate $_POST data?
or I should replace the open and close tags, before sending the comment?
Later edit
This is how I managed to resolve this right now, but I'm still waiting for a suggestion with .htaccess:
$but.prev('textarea').val().replace(/(<\?php)/gi,'-?php ').replace(/(<\?)/gi,'-? ').replace(/\?>/gi,' ?-');
and on the server side
str_replace(array('-?php','?-','-?'), array('`<?php','?>`','`<?'), $_POST['comment']);
I'm working a web application with PHP.
Something wrong is happening that I have never seen before. $_GET is working well, but $_POST does not work exactly. Imagine the form below:
<form action="process.php" method="post">
<input type="text" name="title" />
<input type="submit" value="send" />
</form>
As you see, I've used post for method attribute of the form. In this case, the code below will return error:
<?php
$sentData = $_POST['title'];
echo($sentData);
?>
Error message:
PHP Notice: Undefined index: title in ...
But If I had used $_GET in php scripts and get in the html form codes, everything would work without any error.
There are something more strange.
There are just one form that returns no error while I'm using POST, other forms return error.
When I run this application locally (with Xampp - Apache 2.2) everything works fine without any error, but whenever I run the application an the remote server (IIS 7), I get these errors and problems.
so i would approach this in a couple of different ways:
#Dynamicus is correct, this is only a 'Notice' and not a fatal error (at least you didn't say so in the question), so this may be a difference in your .ini config or with a config definition to suppress errors like so 'error_reporting(0);'
You may want to make a back up of your current running .ini on your local and on the server and copy the working one over to your server and restart Apache and see if that makes a difference.
Why the indexed array (ie $_POST) is producing a warning is somewhat bizarre, but do a "print_r($_POST);" or a "var_dump($_POST);" to see the contents or if anything is off.
if you're using a framework or something that does routing, this could be something to look into.
i hope this helps and there are more settings for error reporting [here] http://php.net/manual/en/function.error-reporting.php
Your input element needs both a name and value property.
Finally I changed the server that my files were located on it. I tried them on another server (same OS), and everything worked fine.
I could not get what was the reason... This was the first time that I was getting this unknown error.
However, thank you all for your suggestions and comments.
i want to receive in a server a xml file sent by java by POST
how can e receive that ? and how can e parse the file, in this case a xml file...
regards.
There are numerous tutorials on handling file uploads (including: http://www.php.net/manual/en/features.file-upload.post-method.php ) if you're actually uploading a file. If, instead, you're posting the contents of the file, the contents will be in the $_POST and $_REQUEST arrays - PHP creates and populates these for you.
This is a broad (and basic) question, so a more specific answer will require you to read some tutorials, try some code, and post specific questions about problems you encounter.
If it's a file upload (enctype="multipart/form-data"), use the $_FILES superglobal: Handling File Uploads.
Otherwise, just refer to it by its form field name: $_POST['xmlfile'].
Either way, parse it using the DOM or SimpleXML.
if it's XMLRPC request, you have to use either $HTTP_RAW_POST_DATA or php://input wrapper.