PHP - empty $_POST and $_FILES - when uploading larger files

Question 1

I have a following problem, I have HTML form that uploads a file with some extra information. But it allows to upload files that only less then 10MB. But when user tries to upload something bigger, both $_POST and $_FILES array are empty (I expected that $_POST will have some values and $_FILES will have some values but will indicate that there is an upload error).

There is a few questions (empty $_POST, $_FILES) like that, but I didn't find any solution, or explanation for it.

HTML form:

<form enctype="multipart/form-data" method="post" action="upload.php">
    <p>
        <input type="hidden" name="MAX_FILE_SIZE" value="10000000" />
        <input type="file" name="image"  />
    </p>
    <p>
        <input type="text" name="other_field" />
    </p>
</form>

upload.php

print_r($_POST);  // array()
print_r($_FILES); // array()
exit;

It works fine, if file size is under 10MB (file size limit is 10MB), and I don't want to increase it, I just want to capture an error in PHP.

Updated (explanation/solution) from PHP site

From PHP site (I missed this section): http://us.php.net/manual/en/ini.core.php#ini.post-max-size

Sets max size of post data allowed. This setting also affects file upload. To upload large files, this value must be larger than upload_max_filesize. If memory limit is enabled by your configure script, memory_limit also affects file uploading. Generally speaking, memory_limit should be larger than post_max_size. When an integer is used, the value is measured in bytes. Shorthand notation, as described in this FAQ, may also be used. If the size of post data is greater than post_max_size, the $_POST and $_FILES superglobals are empty. This can be tracked in various ways, e.g. by passing the $_GET variable to the script processing the data, i.e. , and then checking if $_GET['processed'] is set.

Question 2

As noted in the edited question $_POST and $_FILES are empty when PHP silently discards data (happens when the actual data is bigger than post_max_size). Since HTTP header and $_GET remain intact those can be used to detect the discards.

Option a)

if(intval($_SERVER['CONTENT_LENGTH'])>0 && count($_POST)===0){
    throw new Exception('PHP discarded POST data because of request exceeding post_max_size.');
}

Option b)
Add a GET parameter that tells whether POST data is present.

Question 3

<form name="add" method="post">
     <p>Age:</p>
     <select name="age">
        <option value="1_sre">23</option>
        <option value="2_sam">24</option>
        <option value="5_john">25</option>
     </select>
     <input type="submit" name="submit"/>
</form>

You will have the selected value in $_POST['age'], e.g. 1_sre. Then you will be able to split the value and get the 'stud_name'.

$stud = explode("_",$_POST['age']);
$stud_id = $stud[0];
$stud_name = $stud[1];

Question 4

The usual workflow:

Provide a Javascript rich-text editor for your users such as TinyMCE: http://tinymce.moxiecode.com/
Grab the source generated by the RTE and filter it through HTML Purifier before saving to the database.
Escape the existing HTML: <div id="myHtml" style="display: none"><?php echo htmlentities($html); ?></div>
Re-populate the RTE via Javascript - in the case of TinyMCE as follows: tinyMCE.activeEditor.setContent($('#myHtml').html());

You can also load the HTML content via AJAX.

Question 5

The issue you are facing is due to the fact that post_max_size is set to 8M as default in your php.ini. As your file is 10.4MB you run into the following error:

POST Content-Length of 10237675 bytes exceeds the limit of 8388608 bytes in Unknown

Because you've reached that limit. The trick to fixing this is to simply up that limit by changing the value. You could simply change it directly in your php.ini file to whatever you desire, i.e. 20M.

Or you could set it via your .htaccess file with:

php_value post_max_size 20M
php_value upload_max_filesize 20M

^{Note: I've also added the required upload_max_filesize that you will require for the bigger files :)}

Question 6

Make sure your Max allowed content Length in your web.config is set high enough otherwise you'll get an error. Check your IIS logs to see if that's the issue.

      <requestFiltering>
    <requestLimits maxAllowedContentLength="4294967295" />
    <!-- bytes -->
  </requestFiltering>

PHP - empty $_POST and $_FILES - when uploading larger files

Answers

php,html