Nested arrays in a POST request are not parsed completely by PHP - php

Question

I have been researching this problem for over 12 hours now, with no success.
We have a large custom CMS we have built for a governmental client. The software was developed on PHP 5.3.3. The initial deployment was done on PHP 5.2.2, which caused a few problems, but they finally upgraded their server to PHP 5.3.8. We have little control on exactly which versions gets deployed to their servers.
We have encountered a show-stopper problem. We have an AJAX request which submits a large form via POST with up to 5 levels deep of nested arrays. This has worked fine for several months, but all of a sudden using the new PHP install, we are only getting a partial decode of the data inside the $_POST variable. I have confirmed that PHP is received all the data by inspecting php://input (I also checked that the data was being sent from the browser via Firebug).
This is what we are receiving as the decoded output (via var_dump, I've shortened it for brevity, this should give you a good idea)
Array
(
[db_required_fields] => Array
(
[awr_title] => Array
(
[en] => phil test eng
)
)
[subtitle_intro] => Array
(
[awr_subtitle] => Array
(
[en] =>
)
)
[products] => Array
(
[cp_recall] => Array
(
[1] => Array
(
[product_common_name] => Array
(
[en] =>
)
)
)
)
)
What is missing: each of the [en] should have a peer [fr] array index entry. For example, there should be a [fr] phil test fr entry. Several other index entries at the 2nd array level are missing. The request data itself is not particularly large, roughly 6-7Kb.
What I've done:
- I have had suhosin disabled since it was often mentioned as the cause of similar problems.
- Pored over the phpinfo(); from both a working and the now-working server, trying to identify relevant differences.
- Investigated every module and option within which might affect things (mbstring, for example).
I am now considering writing my own parser for the php://input data, but this seems fraught with (potentially hidden) danger.
Any suggestion or hint ?

Answer 1

I would suggest serializing the post data before sending it. And I would send it as a single string of JSON in one "field." Something like this:
$.ajax({
type: 'POST',
url: 'YOUR URL',
data: {
json: JSON.stringify(form_data) // Where form_data is the JSON object.
},
success: function(response)
{
// Do stuff.
}
});
Then on the server-side, json_decode as follows:
<?php
$_POST = json_decode($_POST['json'], true);
?>
EDIT:
You want json_decode instead of unserialize. Whoops.

Answer 2

You are probably being affected by the new PHP configuration variables max_input_nesting_level or max_input_vars (particularly the latter). Try setting it to a higher value so that PHP doesn't start ignoring some input.

Answer 3

Note, that when you want to change settings like max_input_vars and max_input_nesting_level and you have Suhosin running, you also need to change these params for Suhosin. Example for max_input_vars:
You need to add this to the .htaccess file:
php_value suhosin.post.max_vars 4000
php_value suhosin.request.max_vars 4000
You also need to add the following to your php.ini file in order to allow the change of the suhosin parameters within the .htaccess:
suhosin.perdir = "pr"
"p" allows the change for "post" settings, "r" for request settings.