How can I handle long header declarations in PHP requests?

Question

I'm trying to use the Picasa Web Uploader API to upload galleries of photos to my website. I've been able to implement the button, get it set up in Picasa and get authentication working, but when it comes to processing the POST received by my site from Picasa the $_FILES array is always empty.

I've had a look at the request posted by Picasa using Fiddler, and have been able to identify that the Content-Disposition header at the start of each file multipart is too long - the header sent through by Picasa includes the full path to the file on my server, so it ends up being far more than 128 characters:

Content-Disposition: form-data; name="http://localhost:50216/1f6b3b29edc6f9d8898ede07c1b10e27/image/415603f72f75af1a.jpg?size=640"; filename="DSC_0055.JPG"

It seems that PHP can only handle headers up to 128 characters, and that the whole multi-part section is discarded if the header is too long. (When I reduce the length of this header in Fiddler and re-post the request, my website receives the $_FILE and handles it successfully).

How can I work around this?

Can I set a configuration setting somewhere to allow PHP to handle the long header and receive the data in the $_FILE array?
or, can I access the missing multi-part section in some other way, besides the $_FILE array?

not sure if it's a good or bad sollution, but why not use something like tinyurl to shorten those urls? — yoda, Dec 10 '10 at 21:17
I agree that it's be best to reduce the length of the url in that header @yoda, but unfortunately I don't have any control over the POST request generated by Picasa.. — Dexter, Dec 11 '10 at 18:12

score 3 · Accepted Answer · edited May 23 '17 at 12:04

You're screwed.

But you can use a couple of workarounds to achieve it anyway. You'll need to parse the received form data yourself. Another problem is that PHP won't let you see the raw mutlipart/form-data, so you need:

rewrite the multipart/form-data content type via .htaccess rules
set always_populate_post_data=On in php.ini
read from file_get_contents("php://stdin")
break up the /form-data, which is not that difficult, and PEAR Mail_mimeDecode might help

The alternative is to patch the PHP interpreter. :/

score 1 · Answer 2 · answered Dec 10 '10 at 21:26

Well if you really need access to the raw incoming HTTP body, then you can use http_get_request_body() if you have PECL module installed, if not then there is a stream wrapper I believe:

$httpBody = @file_get_contents('php://input');

Far from ideal though, I was unaware $_FILES had this problem, something to look out for.

How can I handle long header declarations in PHP requests?

2 Answers2