php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #60876 max_input_vars corrupt posted data
Submitted: 2012-01-25 10:03 UTC Modified: 2012-02-03 21:34 UTC
Votes:1
Avg. Score:1.0 ± 0.0
Reproduced:0 of 1 (0.0%)
From: jiri dot reischig at ecn dot cz Assigned:
Status: Not a bug Package: *General Issues
PHP Version: 5.3.9 OS:
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: jiri dot reischig at ecn dot cz
New email:
PHP Version: OS:

 

 [2012-01-25 10:03 UTC] jiri dot reischig at ecn dot cz 
Description:
------------
When you post some data to the php script where are more variables than limit in max_input_vars the php script does not get any information that php don't put any of data to the system variables (for example $_REQUEST[]).
There is only "PHP Warning" generated but the php script is still running without any problem with corrupted dataset from post.

Solution will be to stop executing the script if max_input_vars is reached.

Without stoping the script you are working with currupted dataset and you can make some data inconsistencies in your aplication without any knowledge.

Test script:
---------------
max_input_vars = 1

sending post: test.php?a=1&b=2&c=3

print_r($_REQUEST);

Expected result:
----------------
Stop the script if max_input_vars is reached.


Actual result:
--------------
Array
(
    [a] => 1
)

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-01-25 17:29 UTC] carloschilazo at gmail dot com 
I'm not sure as it would have to absolutley halt the execution; 

Some routines maybe in the script to handle those kind of situations, hence only a 
warning is issued
 [2012-01-30 11:49 UTC] jiri dot reischig at ecn dot cz 
I think that halt the execution is good option because there are o lot of existing scripts that do not have any handling warnings and when the script don't halt scripts got corrupted data without any information about it. So corrupted data was stored to the database for example.
 [2012-02-03 21:34 UTC] rasmus@php.net
-Status: Open +Status: Not a bug
 [2012-02-03 21:34 UTC] rasmus@php.net 
Generally max_input_vars would be set such that it is way above what any normal 
script would expect to receive, so I am not sure this is a real concern. If you 
really do have scripts that take thousands of GET/POST variables, you will need 
to increase this setting and do some input validation. This isn't any different 
from when you didn't have this limit. At these levels there are various arbitrary 
browser and server limits that could be cutting this off without PHP's knowledge, 
so again proper input validation is the only right answer here.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Wed Nov 05 09:00:01 2025 UTC