File Upload

[Thomas Mlynarczyk]

Hello,

I want to upload files via an HTML form and store them somewhere on my
webspace. So far so good. I am just a bit concerned about security issues
and traffic. My provider has set a file size limit of 20MB in php.ini. My
questions are:

1) If some evil web terrorist tries to upload a file which is larger than
the maximum allowed by the setting in php.ini - will the transfer be
cancelled by the server when the limit is reached so that there will not be
unnecessary traffic or will the whole file still be transmitted to the
server?
2) If the transfer is cancelled, is there a way for me to limit the maximum
upload file size to *less* than what my provider specifies - serverside?
3) How can I prevent evil people from uploading file after file (using some
automated process) and thus filling up my webspace and using up my monthly
traffic volume?

Thanks and greetings,
Thomas

P.S.: Does this NG have a FAQ?

--

[Thomas Mlynarczyk]

I've just tried out different settings for post_max_size and
upload_max_file size in php.ini. As was to be expected, the post_max_size
prevails, and if my file is bigger than that, the corresponding
$_FILES['myfile'] does not exist. So it actually makes no sense to make
upload_max_file size bigger than post_max_size - still, this seems to be the
default setting...?

Well, ini_set() is not just for setting this one option. It
certainly works

It doens't have all the values there though, so if they allowed that
value to be changed then it must do something. I now think that it
must take affect on the calling page if anything.

So I have something else to try out tomorrow...

fine with other things, only in this special case it is not very
helpful. But as PHP is running as a CGI with my provider, doesn't
this mean I have my very own "environmen t" all to myself, so
theoretically I should be allowed to modify "my" php.ini somehow?
What actually is the difference between those local and master
values that phpinfo() reports?

To be honest i've never seen a difference between the Local and Master
values on any server yet. I don't think its to do with CGI though -
thats just a different way to get PHP to work, but it is usually a
master thing for the whole server, not separate for individual
folders or whatever. Unless they've given you access via something
other than FTP or web based uploads though, theres no way you'd ever
see PHP.ini anyway. Ask your ISP though, see what they say - probably
won't be very helpful, but just sending a quick e-mail can't hurt,
and could maybe be useful if you get someone who knows something to
respond.

"If", yes, indeed. Still, I will try.

Greetings, Thomas

[David Walker]

> I've just tried out different settings for post_max_size and

upload_max_file size in php.ini. As was to be expected, the post_max_size
prevails, and if my file is bigger than that, the corresponding
$_FILES['myfile'] does not exist. So it actually makes no sense to make
upload_max_file size bigger than post_max_size - still, this seems to be the default setting...?

Possibly if someone uploads by some method other than POST - not GET cos
that isn't big enough, so not sure what's left... Maybe something, but
doesn't matter.

You're getting closer to an answer anyway - just got to make sure it takes
affect on the right page now, which should be easy to try.

David