[UPHPU] upload_max_filesize

[Mac Newbold]

Today at 7:12am, Wade Preston Shearer said:

> I am trying to limit the upload file size on a per virtual host basis (ie, I 
> don't want to do it globally in php.ini). I added it within the virtual host 
> tags in httpd.conf like this:
>
> <VirtualHost *:80>
> 	. . .
> 	php_flag upload_max_filesize 100000
> </VirtualHost>
>
> I also added the following hidden field to the upload form:
>
> <input type="hidden" name="MAX_FILE_SIZE" value="100000" />

While we're on this note, I'll just quickly mention how important it is to 
do both of these, or at least the PHP side of it.

The MAX_FILE_SIZE value is supposed to be respected by browsers, but can 
easily be circumvented. The PHP side though will truly ensure that the 
limit is enforced. In fact, I think PHP cuts the connection when they 
exceed the limit, so your server won't sit there allowing the upload 
indefinitely.

The upload_max_filesize is the max size for one file in the upload. The 
post_max_size that was mentioned is the max size for the entire post, 
including any files that may be submitted. You'll want to set the post max 
according to how many files you're expecting.

Note that both of those settings need to be done in your configuration 
(php.ini, httpd.conf, or .htaccess) and can't be changed at run time, 
because it's already too late to apply any changes. However, the memory 
limit can be changed at run time (even multiple times) using ini_set(). So 
you can allow a part of your code to use more memory, then reduce the 
limit again, for example. When working with large files, I've found PHP 
needs a little more than double the RAM you'd expect your file to take, 
but that probably depends what you are doing with the files.

Little things like this can be a big pain to debug in practice... I'm a 
bit embarrased at how much time I've worked on broken file uploads only to 
realize I wasn't setting the enctype="multipart/form-data" in my form tag.

Mac

--
Mac Newbold		MNE - Mac Newbold Enterprises, LLC
mac at macnewbold.com	http://www.macnewbold.com/