RE: [PHP] problem with file uploads

Clive, "MAX_FILE_SIZE" also suffers from the fact that the error is returned only after the whole file has been uploaded into memory. Dave > -----Original Message----- > From: Clive Hughes [mailto:clive_a_hughes@hotmail.com] > Sent: 30 October 2000 14:31 > To: David.Wakelin@red-m.com; php-general@lists.php.net > Subject: Re: [PHP] problem with file uploads > > > David, > > Looking at the docs ;-) > (http://www.php.net/manual/features.file-upload.php) I > noticed that you can > specify an upload file size in html within a hidden object named > MAX_FILE_SIZE *immediately* after the form tag. > > The example within the docs: > > <FORM ENCTYPE="multipart/form-data" ACTION="_URL_" METHOD=POST> > <INPUT TYPE="hidden" name="MAX_FILE_SIZE" value="1000"> > Send this file: <INPUT NAME="userfile" TYPE="file"> > <INPUT TYPE="submit" VALUE="Send File"> > </FORM> > > This may help, I haven't tested it. > > --Clive > > > >Hi, > > > >I've been looking into file uploads and I've found a problem. > > > >If I set upload_max_filesize=20000000 (in php.ini) and I try > to upload a 80 > >Meg file I do get an error but only after the whole 80 Meg > has been loaded > >into the httpd process (not into a temporary file but into > the address > >space > >of the Apache server). > > > >The system I'm running PHP on only has 32 Meg of memory so an 80 Meg > >process > >does it no good at all. I've also tried > memory_limit=20000000 (in php.ini) > >but that doesn't catch the problem. > > > >This is with php 4.0.1pl2 and 3.0.12 running on RedHat Linux > 6.1 and Apache > >1.3.12 > > > >I think the problem lies in "sapi_read_standard_form_data" from > >main\SAPI.c. > >The function loops around until it has loaded the entire > data into memory > >before passing it onto the rfc1867 code to reject it with > "Max file size of > >20000000 bytes exceeded - file [uploadFile]". > > > >This behaviour makes my server susceptible to a denial of > service attack > >just by uploading a 140 Meg file the system runs out of > memory and swap > >space and slowly grinds to a halt. > > > >Any comments? > > > >Dave > > > >-- > >PHP General Mailing List (http://www.php.net/) > >To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > >For additional commands, e-mail: php-general-help@lists.php.net > >To contact the list administrators, e-mail: > php-list-admin@lists.php.net > > > > ______________________________________________________________ > ___________ > Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. Share information about yourself, create your own public profile at http://profiles.msn.com.