Re: problem with file uploads

David, Looking at the docs ;-) (http://www.php.net/manual/features.file-upload.php) I noticed that you can specify an upload file size in html within a hidden object named MAX_FILE_SIZE *immediately* after the form tag. The example within the docs: <FORM ENCTYPE="multipart/form-data" ACTION="_URL_" METHOD=POST> <INPUT TYPE="hidden" name="MAX_FILE_SIZE" value="1000"> Send this file: <INPUT NAME="userfile" TYPE="file"> <INPUT TYPE="submit" VALUE="Send File"> </FORM> This may help, I haven't tested it. --Clive

Hi, I've been looking into file uploads and I've found a problem. If I set upload_max_filesize=20000000 (in php.ini) and I try to upload a 80 Meg file I do get an error but only after the whole 80 Meg has been loaded into the httpd process (not into a temporary file but into the address space of the Apache server). The system I'm running PHP on only has 32 Meg of memory so an 80 Meg process does it no good at all. I've also tried memory_limit=20000000 (in php.ini) but that doesn't catch the problem. This is with php 4.0.1pl2 and 3.0.12 running on RedHat Linux 6.1 and Apache 1.3.12 I think the problem lies in "sapi_read_standard_form_data" from main\SAPI.c. The function loops around until it has loaded the entire data into memory before passing it onto the rfc1867 code to reject it with "Max file size of 20000000 bytes exceeded - file [uploadFile]". This behaviour makes my server susceptible to a denial of service attack just by uploading a 140 Meg file the system runs out of memory and swap space and slowly grinds to a halt. Any comments? Dave -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net For additional commands, e-mail: php-general-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net

_________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. Share information about yourself, create your own public profile at http://profiles.msn.com.