In PHP, how can I detect that input vars were truncated due to max_input_vars being exceeded?

Question

I know that an E_WARNING is generated by PHP

PHP Warning: Unknown: Input variables exceeded 1000

But how can I detect this in my script?

Answer 1

A "close enough" method would be to check if( count($_POST, COUNT_RECURSIVE) == ini_get("max_input_vars"))

This will cause a false positive if the number of POST vars happens to be exactly on the limit, but considering the default limit is 1000 it's unlikely to ever be a concern.

Answer 2

count($_POST, COUNT_RECURSIVE) is not accurate because it counts all nodes in the array tree whereas input_vars are only the terminal nodes. For example, $_POST['a']['b'] = 'c' has 1 input_var but using COUNT_RECURSIVE will return 3.

php://input cannot be used with enctype="multipart/form-data". http://php.net/manual/en/wrappers.php.php

Since this issue only arises with PHP >= 5.3.9, we can use anonymous functions. The following recursively counts the terminals in an array.

function count_terminals($a) {
  return is_array($a)
           ? array_reduce($a, function($carry, $item) {return $carry + count_terminals($item);}, 0)
           : 1;
}

Answer 3

What works for me is this. Firstly, I put this at the top of my script/handler/front controller. This is where the error will be saved (or $e0 will be null, which is OK).

$e0 = error_get_last();

Then I run a bunch of other processing, bootstrapping my application, registering plugins, establishing sessions, checking database state - lots of things - that I can accomplish regardless of exceeding this condition.. Then I check this $e0 state. If it's not null, we have an error so I bail out (assume that App is a big class with lots of your magic in it)

if (null != $e0) {
    ob_end_clean(); // Purge the outputted Warning
    App::bail($e0); // Spew the warning in a friendly way
}

Tweak and tune error handlers for your own state.

Registering an error handler won't catch this condition because it exists before your error handler is registered.

Checking input var count to equal the maximum is not reliable.

The above $e0 will be an array, with type => 8, and line => 0; the message will explicitly mention input_vars so you could regex match to create a very narrow condition and ensure positive identification of the specific case.

Also note, according to the PHP specs this is a Warning not an Error.

Answer 4

function checkMaxInputVars()
{
    $max_input_vars = ini_get('max_input_vars');
    # Value of the configuration option as a string, or an empty string for null values, or FALSE if the configuration option doesn't exist
    if($max_input_vars == FALSE)
        return FALSE;

    $php_input = substr_count(file_get_contents('php://input'), '&');
    $post = count($_POST, COUNT_RECURSIVE);

    echo $php_input, $post, $max_input_vars;

    return $php_input > $post;
}

echo checkMaxInputVars() ? 'POST has been truncated.': 'POST is not truncated.';

Answer 5

Call error_get_last() as soon as possible in your script (before you have a chance to cause errors, as they will obscure this one.) In my testing, the max_input_vars warning will be there if applicable.

Here is my test script with max_input_vars set to 100:

<?php
if (($error = error_get_last()) !== null) {
    echo 'got error:';
    var_dump($error);
    return;
}
unset($error);

if (isset($_POST['0'])) {
    echo 'Got ',count($_POST),' vars';
    return;
}
?>
<form method="post">
<?php
for ($i = 0; $i < 200; $i++) {
    echo '<input name="',$i,'" value="foo" type="hidden">';
}
?>
<input type="submit">
</form>

Output when var limit is hit:

got error:
array
  'type' => int 2
  'message' => string 'Unknown: Input variables exceeded 100. To increase the limit change max_input_vars in php.ini.' (length=94)
  'file' => string 'Unknown' (length=7)
  'line' => int 0

Tested on Ubuntu with PHP 5.3.10 and Apache 2.2.22.

I would be hesitant to check explicitly for this error string, for stability (they could change it) and general PHP good practice. I prefer to turn all PHP errors into exceptions, like this (separate subclasses may be overkill, but I like this example because it allows @ error suppression.) It would be a little different coming from error_get_last() but should be pretty easy to adapt.

I don't know if there are other pre-execution errors that could get caught by this method.

Answer 6

What about something like that:

$num_vars = count( explode( '###', http_build_query($array, '', '###') ) );

You can repeat it both for $_POST, $_GET, $_COOKIE, whatever.

Still cant be considered 100% accurate, but I guess it get pretty close to it.