Comments on: Detecting file size overflow in PHP

By: file upload to large, $_POST/$_FILE empty so cant throw error - Bizzteams

file upload to large, $_POST/$_FILE empty so cant throw error - Bizzteams — Tue, 03 Apr 2012 18:30:13 +0000

[...] 0 Times in 0 Posts For a solution that may work for you, see Detecting upload file size overflow in PHP | Andrew's Tech Musings Reply With [...]

By: Andrew Curioso

Andrew Curioso — Thu, 21 Oct 2010 02:49:18 +0000

Hi huarong, this post deals explicitly with the error that occurs when post_max_size is exceeded (which is difficult to detect because it wipes out the $_POST and $_FILE arrays).

When upload_max_filesize is exceeded it is actually treated as a normal upload error. So you can detect it by checking $_FILES['form_field_name']['error'] value after the upload and comparing it to UPLOAD_ERR_INI_SIZE. And yes, you should be checking this as well. See also: http://php.net/manual/en/features.file-upload.errors.php

By: huarong

huarong — Thu, 21 Oct 2010 01:37:49 +0000

Should I also check “upload_max_filesize” in php.ini?

By: Andrew Curioso

Andrew Curioso — Fri, 16 Jul 2010 14:22:52 +0000

Hi okjiko,

Because we are first checking to see if REQUEST_METHOD is POST: the CONTENT_LENGTH value should always be set.

However, it is up to the web server to set CONTENT_LENGTH and it is notable that old versions of Apache (and possible other web servers) do not set it. For these servers, the code in this article will not work (that code in the previous comment will produce a false positive) and it may be a good idea to fall back to the “processed=1″ method mentioned in the PHP documentation for those browsers.

By: okjiko

okjiko — Fri, 16 Jul 2010 09:42:51 +0000

I may use the condition in a wrong way, but as far as I am concerned, I’ve added && isset($_SERVER['CONTENT_LENGTH']) to the condition :

if (
$_SERVER['REQUEST_METHOD'] == ‘POST’
&& empty($_POST)
&& empty($_FILES)
&& isset($_SERVER['CONTENT_LENGTH'])//here
&& $_SERVER['CONTENT_LENGTH'] > 0 )

because the index CONTENT_LENGTH doesn’t exist when the page is loaded in the first place.

Hope that helps