PHP max_input_vars

Question

I'm getting a max_input_vars error message.

I understand there's a php.ini setting that can change this starting with version 5.3.9 however, I'm running version 5.1.6.

When I view the configuration information for my 5.1.6 server it shows max_input_vars value is 1000.

My question is: Even though I'm running 5.1.6, I see this setting from phpinfo() but it's not in the php.ini file. Does this mean that the value is hard coded in this version of PHP and can't be changed?

I don't see any reference to `max_input_vars` at all in the PHP 5.1.6 source code so I'm not sure how you are seeing it in phpinfo() output. As far as I know, it didn't exist before 5.3.9... — drew010, Apr 24 '12 at 18:31
Many parameters have defaults that are hard-coded, but you can still assign a new value. The fact that something isn't explicitly set in php.ini doesn't mean you can't use php.ini to change it. — octern, Apr 24 '12 at 18:51
Which error message do you get? Please add it to your question. — hakre, Apr 24 '12 at 19:23
It is still not clear [if there is a limit like max_input_vars in versions before 5.3.9?](http://stackoverflow.com/questions/19042734/is-there-a-limit-like-max-input-vars-in-versions-before-5-3-9) — rubo77, Sep 27 '13 at 04:32
I ran into this error after upgrading from `5.1.6 -> 5.3.3`, then downgrading back to `5.1.6`. Threw me because that option doesn't exist in the `5.1.6` `php.ini` file. I added the line, bumped up the number, and my error/issue went away. — JoshP, Oct 22 '14 at 20:56
Do note that if you are on the bitnami stack then you will have to restart the php-fpm in case you are using it. Simply restarting apache will not help and may not even be required after making a change to /opt/bitnami/php/etc/php.ini — Shrenik, Sep 22 '15 at 11:06
to know where is php.ini (in my case a docker container), running info.php should help — bcag2, Mar 11 '21 at 10:10
@bcag2 you probably mean putting `phpinfo()` inside a file and call it via the browser. For the CLI interface (i.e. running PHP apps from the shell), the best way to figure it out is something like: `$ php -i | grep php\.ini` (assuming that `php` is in the `$PATH`, of course) — Gwyneth Llewelyn, Jul 07 '21 at 22:35
I would also suggest that @user39653 specifies under which web server PHP is running; Apache can be configured to run PHP either as a module or an independent external process (handled separately with its own configuration), usually FastCGI; `nginx`can _only_ run PHP externally; etc. for other web servers. It would also be important to tell what operating system is running the web server and PHP, as well as its version; different systems have (often) quite different configurations... — Gwyneth Llewelyn, Jul 07 '21 at 22:40

lubosdz · Answer 1 · 2016-11-16T11:54:59.677

113

Reference on PHP net:

http://php.net/manual/en/info.configuration.php#ini.max-input-vars

Please note, you cannot set this directive in run-time with function ini_set(name, newValue), e.g.

ini_set('max_input_vars', 3000);

It will not work.

As explained in documentation, this directive may only be set per directory scope, which means via .htaccess file, httpd.conf or .user.ini (since PHP 5.3).

See http://php.net/manual/en/configuration.changes.modes.php

Adding the directive into php.ini or placing following lines into .htaccess will work:

php_value max_input_vars 3000
php_value suhosin.get.max_vars 3000
php_value suhosin.post.max_vars 3000
php_value suhosin.request.max_vars 3000

edited Nov 16 '16 at 11:54

answered Jan 04 '13 at 23:12

lubosdz

4,210
2
29
43

3

Or placing all 3 suhosin directives on php.ini is ok. – Alain Tiemblo Dec 10 '13 at 10:29
1

If you have access to php.ini, the directive syntax is `max_input_vars = 3000` (+ equal sign). – Parapluie Nov 27 '17 at 19:25
@shorif2000 I had similar problem in IIS, PHP 7 w/ wincache, using .user.ini file. First problem was cache. I moved the lines around in random order, in .user.ini until it finally worked. Second problem, changing 1000 to 2000 had no effect, but when I moved the entire line to a different line, then it worked. – Ryan Briscall May 10 '18 at 15:19
This works for Apache running PHP as a module. Other web servers or Apache configurations might not use/read/understand `.htaccess`, so the best choice might be placing those directives inside `.user.ini` (unless _that_ is also blocked...). – Gwyneth Llewelyn Jul 07 '21 at 22:42
Just a note - if you are using a fcgi handler, php_value in .htaccess won't work. You need to use SetEnv directive then, like this: SetEnv php_value "max_input_vars=5000" – Spaceploit Sep 24 '21 at 21:33

Narf · Accepted Answer · 2014-09-09T07:19:04.993

52

You can add it to php.ini and it should work - just tested it on PHP 5.3.6.

edited Sep 09 '14 at 07:19

answered Apr 24 '12 at 18:32

Narf

14,600
3
37
66

Thanks, that's worth knowing, although I'm on 5.3.3 and no joy. – Vaughany Jul 05 '12 at 07:53
thanks for that obvious pointer, seriously - I was looking for this setting for an hour....until i saw this, add it dummy! – jamesTheProgrammer Aug 24 '12 at 13:56
3

@Vaughany Do note that if you are on the bitnami stack then you will have to restart the php-fpm in case you are using it. Simply restarting apache will not help and may not even be required after making a change to /opt/bitnami/php/etc/php.ini – Shrenik Sep 22 '15 at 11:06

Vaughany · Answer 3 · 2012-07-05T08:33:09.207

Have just attempted this fix with 5.3.3 and there's no change. Googling around I found this web page http://anothersysadmin.wordpress.com/2012/02/16/php-5-3-max_input_vars-and-big-forms/ detailing other settings which need changing if your server uses the Suhosin patch which Apache under Debian does.

The site explains:

So, if you want to increase this number to, say, 3000 from the default number which is 1000, you have to put in your php.ini these lines:

max_input_vars = 3000 suhosin.post.max_vars = 3000 suhosin.request.max_vars = 3000

I tested it (added settings to php.ini both in /etc/php5/apache2 and /etc/php5/cli, and restarted Apache successfully) but still no max_input_vars variable in phpinfo.

A few sites point to PHP 5.3.9 as the first PHP version in which this change will take, so my fault for not RTM properly in the first place, although I'm interested to see people reporting it working in version above 5.3.3 but below 5.3.9.

Thankfully, recent versions of PHP (7.3+) got rid of the Suhosin patch (designed for PHP 5+), or, more precisely, whatever was being patched via Suhosin is not part of 'mainline' PHP. There is now [Suhosin-NG](https://suhosin.org/), though. — Gwyneth Llewelyn, Jul 07 '21 at 22:48

nokieng · Answer 4 · 2018-02-20T17:16:05.717

15

It's 2018 now.And I just got stuck on this problem when I must send a request that exceeds the max_input_vars. And I came up with a solution that newie like me forgot to restart php fpm service after changing the max_input_vars param. because I only tried to restart apache2 service, but not php fpm

uncomment code at /etc/php/7.0/fpm/php.ini and set number as you wish
max_input_vars = 4000
restart php fpm service, as I use php 7. Therefore,
sudo service php7.0-fpm restart

Hope it helps
Tested on Debian Stretch, php7.0

edited Feb 20 '18 at 17:16

answered Feb 20 '18 at 17:10

nokieng

1,858
20
24

2

I wasted a full day trying to figure out how to make sure changes are applied and read so many solutions. They all mentioned after making changes to php.ini you should restart apache, which didn't make a difference. Restarting php7.2-fpm as noted in this solution solved the problem! – nightrain Aug 25 '20 at 17:48
Just for the record: modern installations of Apache will usually _not_ launch PHP from an embedded module — as has been the practice for decades — but rather from a separate FastCGI process, usually `phpX.Y-fpm`. This is consistent to how PHP has always worked under `nginx` and is generally considered the 'best' option these days (there are, of course, edge cases when it may make sense to keep a module inside Apache — but those exceptions are becoming rare...) – Gwyneth Llewelyn Jul 07 '21 at 22:22

score 9 · Answer 5 · answered Apr 30 '14 at 08:47

9

You need to uncomment max_input_vars value in php.ini file and increase it (exp. 2000), also dont forget to restart your server this will help for 99,99%.

answered Apr 30 '14 at 08:47

Oleg Sapishchuk

667
6
18

This did not work for me on Ubuntu 12.04. Set it to 3000 and used `sudo service apache2 restart`. Do I need to restart Ubuntu? – motorbaby Oct 11 '16 at 18:50
@motorbaby, If you had this value commented in php.ini, then you only had uncomment and restart services. Restart OS is not needed, but could be done, but I don't see any sense in this. If you didn't have it, then use @ lubosdz solution. If both will not help, then check if you are doing changes in right place, for example somehow you have several php.ini files. Also you can try just usage of "sudo service apache2 reload" for reloading configurations – Oleg Sapishchuk Oct 12 '16 at 05:38
The line was there. I removed `;` and changed the value to 3000. The problem was likely the browser's cache. Closed PHPMyAdmin and opened in a new tab and it now works. Thanks! – motorbaby Oct 12 '16 at 19:07

score 5 · Answer 6 · edited Oct 06 '22 at 12:26

5

Put this line on .htaccess file of your site

php_value max_input_vars 6000

edited Oct 06 '22 at 12:26

Paulo Boaventura

1,365
1
9
29

answered May 02 '18 at 09:54

Rahul K A

322
4
4

... if you're using Apache, of course; other web servers use different conventions. – Gwyneth Llewelyn Jul 07 '21 at 22:24

score 4 · Answer 7 · answered Sep 08 '16 at 12:57

Use of this directive mitigates the possibility of denial of service attacks which use hash collisions. If there are more input variables than specified by this directive, an E_WARNING is issued, and further input variables are truncated from the request.

I can suggest not to extend the default value which is 1000 and extend the application functionality by serialising the request or send the request by blocks. Otherwise, you can extend this to configuration needed.

It definitely needs to set up in the php.ini

score 3 · Answer 8 · answered Feb 20 '18 at 06:07

Note that you must put this in the file ".user.ini" in Centos7 rather than "php.ini" which used to work in Centos6. You can put ".user.ini" in any subdirectory in order to affect only that directory.

.user.ini :

max_input_vars = 3000

Tested on Centos7 and PHP 5.6.33.

score 2 · Answer 9 · edited Jan 21 '19 at 06:52

Just had the same problem adding menu items to Wordpress. I am using Wordpress 4.9.9 on Ubuntu 18.04, PHP 7.0. I simply uncommented the following line and increased it to 1500 in /etc/php/7.0/apache2/php.ini

; How many GET/POST/COOKIE input variables may be accepted<br>
max_input_vars = 1500

Then used the following to effect the change:

sudo apache2ctl configtest  #(if it does not return ok Apache will not start)
sudo service apache2 reload

Hope that helps.

score 1 · Answer 10 · answered Aug 28 '19 at 07:28

"PHP message: PHP Warning: Unknown: Input variables exceeded 1000. To increase the limit change max_input_vars in php.ini.

This php configuration parameter max_input_vars will affect not only your GET / POST / COOKIES parameters it also controls your any Form Input.

To set or change its value follow the below steps.

1) check the existing setting / value by viewing it in your php.ini file Locate php.ini file by using

<?php echo getinfo(); ?>

find below key: Loaded Configuration File : /etc/php/5.6/fpm/php.ini

2) Open the php.ini file in editable mode and do search for max_input_vars This line may be commented in your existing default setting with default value of 1000 , So remove ; to uncomment it and Edit it with your suitable value e.g. 2500.

3) Save the file and Restart the Services of PHP by using below sudo service php5.6-fpm restart

Similarly you can update any other similar PHP Configuration to your ease.

score 1 · Answer 11 · answered Dec 24 '19 at 13:32

Just to complement. On a shared server using mod_suphp I was having the same issue.

Declaring 4 max_input_vars (suhosin included), didn't solved it, it just kept truncating on 1000 vars (default), and declaring "php_value max_input_vars 6000" on .htaccess threw error 500.

What solved it was to add the following on .htaccess, which applies the php.ini file recursively to that path

suPHP_ConfigPath /home/myuser/public_html

score 1 · Answer 12 · answered Dec 30 '21 at 17:13

If you are using something like wodby (docker4php or docker4drupal) or lando or trying to find an answer "why php.ini doesn't work" (like me), these tools are using their own way to pass configuration into php

https://github.com/wodby/php#php-and-php-fpm-configuration

I was trying to set max_input_vars, in wodby+docker-compose you do it like so

  php:
    image: wodby/drupal-php:$PHP_TAG
    container_name: "${PROJECT_NAME}_php"
    environment:
      PHP_MAX_INPUT_VARS: 9999

score 0 · Answer 13 · answered Mar 29 '18 at 22:10

New Cpanels block to see the .htaccess file or if you add a .user.ini you wont be able to see it. but with a little hack you can make it work. Edit for example wp-config.php and in the URL bar replace wp-config.php by .htaccess now you can paste the values and save it. enter image description here

score -6 · Answer 14 · edited Nov 26 '14 at 10:26

-6

Yes, add it to the php.ini, restart apache and it should work.

You can test it on the fly if you want to with ini_set("max_input_vars",100)

edited Nov 26 '14 at 10:26

IluTov

6,807
6
41
103

answered Apr 24 '12 at 18:47

Quaid

333
1
8

9

This will not work, see http://www.php.net/manual/en/info.configuration.php. Must be set per directory virtual host or htaccess, not ini_set. – lubosdz Mar 06 '13 at 09:40
We can set this variable through ini_set function. Why this answer got down votes? php.net/manual/en/info.configuration.php – Ahmad Aug 30 '19 at 04:47
@Ahmad because actually you _cannot_ change it via `ini_set()`. If you look closely at that page, you'll see that `max_input_vars` is flagged as `PHP_INI_PERDIR` — which means [_Entry can be set in php.ini, .htaccess, httpd.conf or .user.ini_](https://www.php.net/manual/en/configuration.changes.modes.php) — thus, setting it via `ini_set()` is **not** allowed! – Gwyneth Llewelyn Jul 07 '21 at 22:30

PHP max_input_vars

14 Answers14

Linked

Related