max_file_size

[taras.di]

Does the hidden field MAX_FILE_SIZE have any effect on a file
submission that is too large (on the client side)? The PHP manual at
http://cn.php.net/manual/en/features.file-upload.php suggests that, if
MAX_FILE_SIZE is supplied, then a browser should warn the user that the
file they are attempting to upload is too large, and this would prevent
the user from needlessly uploading files that the server then tells
them is too large. I have tried tests on both FF 1.5 & IE 6, and both
submit a file that is too large as indicated by the MAX_FILE_SIZE
field. The relevant HTML code I'm using is showed below.

<form enctype="multipart/form-data" method="post">
<input type="text" value="'.$filePath.'" />
<input type="hidden" name="MAX_FILE_SIZE" value="'.$maxSize.'" />
<input type="file" id="fileInput" name="theFile" />
<input type="hidden" name="formnumber" value="'.$fileNumber.'" /'
<input type="submit" name="submit" />
</form>

Thanks

taras

[Steven Saunderson]

On 10 Jul 2006 19:38:57 -0700, ta******@gmail.com wrote:

The relevant HTML code I'm using is showed below.

<form enctype="multipart/form-data" method="post">
<input type="text" value="'.$filePath.'" />
<input type="hidden" name="MAX_FILE_SIZE" value="'.$maxSize.'" />

^^ ^^ ^
Pardon me if this is a silly question due to my limited knowledge of PHP
but why have you got the single quotes and dots surrounding $maxsize ?
Also the /at the end looks like XHTML not HTML.

I just tested a similar upload form with MAX_FILE_SIZE set to 1500 and
neither Opera 8 or IE 5.5 complained about larger files. It does seem
pretty useless.

--
Steven

[Sherm Pendley]

ta******@gmail.com writes:

Does the hidden field MAX_FILE_SIZE have any effect on a file
submission that is too large (on the client side)? The PHP manual at
http://cn.php.net/manual/en/features.file-upload.php suggests that, if
MAX_FILE_SIZE is supplied, then a browser should warn the user that the
file they are attempting to upload is too large

Here's the actual text from that page:

"The MAX_FILE_SIZE hidden field (measured in bytes) must precede the file
input field, and its value is the maximum filesize accepted. This is an
advisory to the browser, PHP also checks it. Fooling this setting on the
browser side is quite easy, so never rely on files with a greater size
being blocked by this feature."

I don't know of any browsers that take PHP's "advisory" into account, and I
don't see anything at <http://w3c.orgthat indicates they should.

The primary, and in practical terms *only*, use for MAX_FILE_SIZE is for
server-side checking.

sherm--

--
Web Hosting by West Virginians, for West Virginians: http://wv-www.net
Cocoa programming in Perl: http://camelbones.sourceforge.net

[Harlan Messinger]

Sherm Pendley wrote:

ta******@gmail.com writes:

>Does the hidden field MAX_FILE_SIZE have any effect on a file
submission that is too large (on the client side)? The PHP manual at
http://cn.php.net/manual/en/features.file-upload.php suggests that, if
MAX_FILE_SIZE is supplied, then a browser should warn the user that the
file they are attempting to upload is too large

Here's the actual text from that page:

"The MAX_FILE_SIZE hidden field (measured in bytes) must precede the file
input field, and its value is the maximum filesize accepted. This is an
advisory to the browser, PHP also checks it. Fooling this setting on the
browser side is quite easy, so never rely on files with a greater size
being blocked by this feature."

I don't know of any browsers that take PHP's "advisory" into account, and I
don't see anything at <http://w3c.orgthat indicates they should.

Exactly. How could someone who creates a server-side technology expect
to decree browser behavior and have it magically happen? Or that even in
future versions, browser makers would automatically implement his
decree? If such a feature were to be implemented in HTML at all, it
would be as an attribute of the file-type INPUT tag.

[taras.di]

Thanks for the replies everyone.

It seems like an obvious feature to have in browsers, so I'm wondering
why it hasn't been implemented (even if it isn't part of the HTML
standards yet)

Taras