brianlange Posted May 22, 2012 Share Posted May 22, 2012 By default max_input_vars is set to 1000 (5.3). This can cause issues if a form has more than a thousand input values or a post array has more than 1k elements. Increasing the limit is said to be a security risk. Is the risk minimal? Can you raise the limit with minimal risk involved? Link to comment https://forums.phpfreaks.com/topic/262947-increasing-max_input_vars-limit/ Share on other sites More sharing options...
Andy-H Posted May 22, 2012 Share Posted May 22, 2012 Look at this: Starts at about 15 mins. I think this is the right video anyway. Link to comment https://forums.phpfreaks.com/topic/262947-increasing-max_input_vars-limit/#findComment-1347721 Share on other sites More sharing options...
kicken Posted May 22, 2012 Share Posted May 22, 2012 Is the risk minimal? Can you raise the limit with minimal risk involved? Increasing the limit mainly just means that a user can eat up more memory by posting a lot of data, but there are other directives to control this as well, such as max post size and memory limit. I'd say the risk in increasing it is fairly minimal. However, I'd also say if you have a page with 1k or more inputs, you might want to re-think the design and UI of that page as I'd guess there is most likely a better way to handle it. Link to comment https://forums.phpfreaks.com/topic/262947-increasing-max_input_vars-limit/#findComment-1347778 Share on other sites More sharing options...
Andy-H Posted May 22, 2012 Share Posted May 22, 2012 Is the risk minimal? Can you raise the limit with minimal risk involved? Increasing the limit mainly just means that a user can eat up more memory by posting a lot of data, but there are other directives to control this as well, such as max post size and memory limit. I'd say the risk in increasing it is fairly minimal. However, I'd also say if you have a page with 1k or more inputs, you might want to re-think the design and UI of that page as I'd guess there is most likely a better way to handle it. Completely agree, however, as Rasmus says in the video I posted, it's OK for X(1000 he says) requests, but get to Y(32,299) and PHP can take around 40 seconds to load the script. I think DDOS'ing a server with simple HTTP requests for the offending page would be extremely easy. Link to comment https://forums.phpfreaks.com/topic/262947-increasing-max_input_vars-limit/#findComment-1347783 Share on other sites More sharing options...
brianlange Posted May 22, 2012 Author Share Posted May 22, 2012 Thanks. So it sounds like increasing the limit to 5k or so is probably ok. Yes, the form should be redesigned but this is not an option at the moment. Link to comment https://forums.phpfreaks.com/topic/262947-increasing-max_input_vars-limit/#findComment-1347808 Share on other sites More sharing options...
Andy-H Posted May 22, 2012 Share Posted May 22, 2012 There's always a risk, but I don't imagine 5k will be much of a problem, on a side note, who fills out a form with 5,000 fields Link to comment https://forums.phpfreaks.com/topic/262947-increasing-max_input_vars-limit/#findComment-1347809 Share on other sites More sharing options...
brianlange Posted May 22, 2012 Author Share Posted May 22, 2012 Thanks for the great responses. The form accepts html and then parses the links that are entered into a new form. There are multiple individual checkboxes (not arrays) associated with each link so if there are a couple hundred links this leads to 1k+ plus form elements. Link to comment https://forums.phpfreaks.com/topic/262947-increasing-max_input_vars-limit/#findComment-1347815 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.