File Upload Size Restrction/Security

I am having a bit of a problem trying to make a file upload "safe". I have the MAX_FILE_SIZE hidden field set in my form, but if someone were to malisciously remove that and then post an enourmous file multiple times, it could cause the servers resources to be chewed up. I have the max file size directive in php.ini set to the default (2MB), but the server still seems to allow the whole file to arrive first, before applying that limit. In other words, these large maliscious files are getting there before they are removed because of the directive and still hogging resources while they are transferred. Am I wrong in how this is working? Is there a way to cut the file off midstream if it exceeds a certain size? Thanks in advance for any help/explanations. -- ls