php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #49983 PHP silently discards POST variables after 1000 variables.
Submitted: 2009-10-24 01:51 UTC Modified: 2009-10-24 21:55 UTC
From: dgrace at wingsnw dot com Assigned:
Status: Closed Package: *General Issues
PHP Version: 5.2.11 OS: Debian Linux
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: dgrace at wingsnw dot com
New email:
PHP Version: OS:

 

 [2009-10-24 01:51 UTC] dgrace at wingsnw dot com 
Description:
------------
PHP will quietly discard variables POSTed to a form after the 1000th posted variable.  This value seems to be consistent and is not affected by post_max_size.

I've searched the documentation about php.ini directives and could not find anything suggesting this limit can be changed.

This is especially problematic if presenting a list of items to be selected by the user (i.e. listing 1000+ items with an option to delete the selected items).  The discard occurs regardless of the POST variable names -- i.e. if they are all named "id[]" to convert to an array, the failure will still happen.

Tested with both IE7 and FF3.5.3 to confirm that it was not a browser limitation.

Tested on Apache/2.2.13 (Debian) 

Reproduce code:
---------------
<?php
/* Test case for bug report: See how many POST variables make it back to PHP. */
error_reporting(E_ALL);

$numvars = 10000;
echo '<html><body>';

echo '<p>$_POST contained ', ((int) @count($_POST)), ' out of ', $numvars, ' variable(s)</p>';

echo "<form action=\"?\" method=\"post\">";
for($n = 0 ; $n < $numvars; ++$n) { echo '<input type="hidden" name="v', $n, '" value="0" />'; }
echo '<input type="submit" name="submit" value="Run Test" />';
echo '</form>';
echo '</body></html>';


Expected result:
----------------
After submitting the form once, 10001 out of 10000 variables (since the submit button itself is an additional _POST variable, the count would be off in this case)

Actual result:
--------------
1000 of 10000 variables

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2009-10-24 20:51 UTC] sniper@php.net 
Obviously it's some misconfiguration / limitation of your server setup:
"$_POST contained 10001 out of 10000 variable(s)"

You should check your error logs, php.ini for post_max_size and especially the webserver setting you use. I tried with lighttpd + PHP (FastCGI) and had no problems.
 [2009-10-24 21:55 UTC] dgrace at wingsnw dot com 
Closing this myself -- I found the cause.

Debian's PHP packages include the Suhosin patch (http://www.hardened-php.net/suhosin/) which, among other features, adds a configuration option for suhosin.post.max_vars.  I didn't see a relevant option in php.ini, but it shows on phpinfo();
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Thu Jul 03 00:01:35 2025 UTC