Increasing max_input_vars limit

[brianlange]

By default max_input_vars is set to 1000 (5.3). This can cause issues if a form has more than a thousand input values or a post array has more than 1k elements.

Increasing the limit is said to be a security risk. Is the risk minimal? Can you raise the limit with minimal risk involved?

 

 

[Andy-H]

Look at this:

 

 

 

 

Starts at about 15 mins.

 

 

I think this is the right video anyway.

[kicken]

Is the risk minimal? Can you raise the limit with minimal risk involved?

 

Increasing the limit mainly just means that a user can eat up more memory by posting a lot of data, but there are other directives to control this as well, such as max post size and memory limit.  I'd say the risk in increasing it is fairly minimal.

 

However, I'd also say if you have a page with 1k or more inputs, you might want to re-think the design and UI of that page as I'd guess there is most likely a better way to handle it.

 

[Andy-H]

Is the risk minimal? Can you raise the limit with minimal risk involved?

 

Increasing the limit mainly just means that a user can eat up more memory by posting a lot of data, but there are other directives to control this as well, such as max post size and memory limit.  I'd say the risk in increasing it is fairly minimal.

 

However, I'd also say if you have a page with 1k or more inputs, you might want to re-think the design and UI of that page as I'd guess there is most likely a better way to handle it.

 

 

Completely agree, however, as Rasmus says in the video I posted, it's OK for X(1000 he says) requests, but get to Y(32,299) and PHP can take around 40 seconds to load the script.

 

 

I think DDOS'ing a server with simple HTTP requests for the offending page would be extremely easy.

[brianlange]

Thanks. So it sounds like increasing the limit to 5k or so is probably ok.

Yes, the form should be redesigned but this is not an option at the moment.

[Andy-H]

There's always a risk, but I don't imagine 5k will be much of a problem, on a side note, who fills out a form with 5,000 fields

[brianlange]

Thanks for the great responses.

The form accepts html and then parses the links that are entered into a new form. There are multiple individual checkboxes (not arrays) associated with each link so if there are a couple hundred links this leads to 1k+ plus form elements.