php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #49983 PHP silently discards POST variables after 1000 variables.
Submitted: 2009-10-24 01:51 UTC Modified: 2009-10-24 21:55 UTC
From: dgrace at wingsnw dot com Assigned:
Status: Closed Package: *General Issues
PHP Version: 5.2.11 OS: Debian Linux
Private report: No CVE-ID: None
View Add Comment Developer Edit
 [2009-10-24 01:51 UTC] dgrace at wingsnw dot com 
Description:
------------
PHP will quietly discard variables POSTed to a form after the 1000th posted variable.  This value seems to be consistent and is not affected by post_max_size.

I've searched the documentation about php.ini directives and could not find anything suggesting this limit can be changed.

This is especially problematic if presenting a list of items to be selected by the user (i.e. listing 1000+ items with an option to delete the selected items).  The discard occurs regardless of the POST variable names -- i.e. if they are all named "id[]" to convert to an array, the failure will still happen.

Tested with both IE7 and FF3.5.3 to confirm that it was not a browser limitation.

Tested on Apache/2.2.13 (Debian) 

Reproduce code:
---------------
<?php
/* Test case for bug report: See how many POST variables make it back to PHP. */
error_reporting(E_ALL);

$numvars = 10000;
echo '<html><body>';

echo '<p>$_POST contained ', ((int) @count($_POST)), ' out of ', $numvars, ' variable(s)</p>';

echo "<form action=\"?\" method=\"post\">";
for($n = 0 ; $n < $numvars; ++$n) { echo '<input type="hidden" name="v', $n, '" value="0" />'; }
echo '<input type="submit" name="submit" value="Run Test" />';
echo '</form>';
echo '</body></html>';


Expected result:
----------------
After submitting the form once, 10001 out of 10000 variables (since the submit button itself is an additional _POST variable, the count would be off in this case)

Actual result:
--------------
1000 of 10000 variables

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2009-10-24 20:51 UTC] sniper@php.net 
Obviously it's some misconfiguration / limitation of your server setup:
"$_POST contained 10001 out of 10000 variable(s)"

You should check your error logs, php.ini for post_max_size and especially the webserver setting you use. I tried with lighttpd + PHP (FastCGI) and had no problems.
 [2009-10-24 21:55 UTC] dgrace at wingsnw dot com 
Closing this myself -- I found the cause.

Debian's PHP packages include the Suhosin patch (http://www.hardened-php.net/suhosin/) which, among other features, adds a configuration option for suhosin.post.max_vars.  I didn't see a relevant option in php.ini, but it shows on phpinfo();
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Fri Apr 26 10:01:31 2024 UTC