HTML Upload MAX_FILE_SIZE does not appear to work

Question

I am wondering how is the hidden field named MAX_FILE_SIZE supposed to work?

<form action="" method="post" enctype="multipart/form-data">
    <!-- in byes must preceed file field -->
    <input type="hidden" name="MAX_FILE_SIZE" value="2097152" /> 
    <input type="file" name="upload" />

    <input type="submit" name="submit" value="Submit" />
</form>

I uploaded a 4MB+ file but I got no warning from client side (I am not talking about server side). What is it MAX_FILE_SIZE supposed to do?

UPDATE

OK so its for PHP to impose a "soft" limit. But is there any difference between using it and checking something like $_FILES['upload']['size'] < 2000 in code?

score 45 · Accepted Answer · edited Jun 20 '20 at 09:12

45

MAX_FILE_SIZE is in ~~KB not~~ bytes. You were right, it is in bytes. So, for a limit of 4MB convert 4MB in bytes {1024 * (1024 * 4)} try:

<input type="hidden" name="MAX_FILE_SIZE" value="4194304" />

Update 1

As explained by others, you will never get a warning for this. It's there just to impose a soft limit on server side.

Update 2

To answer your sub-question. Yes, there is a difference, you NEVER trust the user input. If you want to always impose a limit, you always must check its size. Don't trust what MAX_FILE_SIZE does, because it can be changed by a user. So, yes, you should check to make sure it's always up to or above the size you want it to be.

The difference is that if you have imposed a MAX_FILE_SIZE of 2MB and the user tries to upload a 4MB file, once they reach roughly the first 2MB of upload, the transfer will terminate and the PHP will stop accepting more data for that file. It will report the error on the files array.

edited Jun 20 '20 at 09:12

Community

1
1

answered Jun 13 '11 at 08:10

Shef

44,808
15
79
90

I updated my question with another "sub" question. Also from the PHP site, it says bytes tho ... http://i.imgur.com/8ORnU.png – JM at Work Jun 13 '11 at 08:29
Yes, you are right it is in bytes. Jumped to conclusion early on. I updated my answer with an answer to your sub-question. – Shef Jun 13 '11 at 08:44
I guess it means I should still include that line since it means the user will get notified faster? – JM at Work Jun 13 '11 at 09:01
Well, yeah, it will almost help you and the users if it's there, but don't rely on it for size imposing limits, because they could change it and you will end up with much bigger files uploaded on your server. – Shef Jun 13 '11 at 09:22
I wonder what is meant by "the PHP will stop accepting more data". Is this really true that not the whole file will be uploaded? Or is this merely a hint that is send along so you can then check on your own? – NoDataDumpNoContribution Feb 24 '15 at 20:23
@Trilarion "**the transfer will terminate** and the PHP will stop accepting more data for that file. It will report the error on the files array." Yes, it is true, the whole file will not be uploaded. – Shef Feb 24 '15 at 20:29

score 42 · Answer 2 · edited May 23 '17 at 12:25

Before I start, please let me emphasize that the size of the file must be checked on the server side. If not checked on server side, malicious users can override your client side limits, and upload huge files to your server. DO NOT TRUST THE USERS.

I played a bit with PHP's MAX_FILE_SIZE, it seemed to work only after the file was uploaded, which makes it irrelevant (again, malicious user can override it quite easily).

The javascript code below (tested in Firefox and Chrome), based on Matthew's post, will warn the user (the good, innocent one) a priori to uploading a large file, saving both traffic and the user's time:

<form method="post" enctype="multipart/form-data" 
onsubmit="return checkSize(2097152)">    
<input type="file" id="upload" />
<input type="submit" />

<script type="text/javascript">
function checkSize(max_img_size)
{
    var input = document.getElementById("upload");
    // check for browser support (may need to be modified)
    if(input.files && input.files.length == 1)
    {           
        if (input.files[0].size > max_img_size) 
        {
            alert("The file must be less than " + (max_img_size/1024/1024) + "MB");
            return false;
        }
    }

    return true;
}
</script>

Beware that property 'size' on files[0] does not exist in IE (tested on IE9) — psulek, Sep 17 '12 at 14:57

score 7 · Answer 3 · edited Feb 24 '15 at 20:28

7

To anyone who had been wonderstruck about some files being easily uploaded and some not, it could be a size issue. I'm sharing this as I was stuck with my PHP code not uploading large files and I kept assuming it wasn't uploading any Excel files. So, if you are using PHP and you want to increase the file upload limit, go to the php.ini file and make the following modifications:

upload_max_filesize = 2M

to be changed to

upload_max_filesize = 10M
post_max_size = 10M

or the size required. Then restart the Apache server and the upload will start magically working. Hope this will be of help to someone.

edited Feb 24 '15 at 20:28

Nisse Engström

4,738
23
27
42

answered Jul 16 '13 at 06:51

Nandakishore

95
1
1

5

This has nothing to do with the question. – Álvaro González Jul 17 '13 at 07:04
1

Sometimes people have no clue what is causing their failure, and having this answer here sure does help, as it did me. I suspected it had something to do with max filesize, and indeed it was the php.ini value that needed changing. – Nag Hammadi Jul 31 '13 at 17:28
2

This was extremely useful information for me and was directly related to the question. My file upload appeared not to work because I needed to make this change in my php.ini file. – The Debi Oct 16 '13 at 21:05
1

This answer could be a comment to the question. – NoDataDumpNoContribution Feb 24 '15 at 20:24

Álvaro González · Answer 4 · 2011-06-13T08:31:52.013

4

Actually, it doesn't really work. You can find an explanation in one of the comments in the manual page: http://www.php.net/manual/en/features.file-upload.php#74692

Answer to updated question: the obvious difference is that server-side checks are reliable, client-side checks are not.

edited Jun 13 '11 at 08:31

answered Jun 13 '11 at 08:07

Álvaro González

142,137
41
261
360

score 3 · Answer 5 · answered Jul 14 '16 at 10:35

PHP.net explanation about MAX_FILE_SIZE hidden field.

The MAX_FILE_SIZE hidden field (measured in bytes) must precede the file input field, and its value is the maximum filesize accepted by PHP. This form element should always be used as it saves users the trouble of waiting for a big file being transferred only to find that it was too large and the transfer failed. Keep in mind: fooling this setting on the browser side is quite easy, so never rely on files with a greater size being blocked by this feature. It is merely a convenience feature for users on the client side of the application. The PHP settings (on the server side) for maximum-size, however, cannot be fooled.

http://php.net/manual/en/features.file-upload.post-method.php

I've always felt that this should be reported as documentation error against the PHP manual issue tracker. If not wrong, it's at least too ambiguous. — Álvaro González, Jul 15 '16 at 12:45

score 3 · Answer 6 · edited Feb 25 '15 at 17:03

3

It's only supposed to send the information to the server. The reason that it must preceed the file field is that it has to come before the file payload in the request for the server to be able to use it to check the size of the upload.

How the value is used on the server depends on what you use to take care of the upload. The code is supposedly intended for a specific upload component that specifically looks for that value.

It seems that the built in upload support in PHP is one to use this field value.

edited Feb 25 '15 at 17:03

NoDataDumpNoContribution

10,591
9
64
104

answered Jun 13 '11 at 08:07

Guffa

687,336
108
737
1,005

1

@JM at Work: The difference is just that the check is done earlier in the process, before the PHP code in the page is executed. – Guffa Jun 13 '11 at 09:08
Could you maybe link to a bit more documentation on the "built in upload support in PHP"? – NoDataDumpNoContribution Feb 24 '15 at 20:25
@Trilarion: The upload is documented here: http://php.net/manual/en/features.file-upload.post-method.php – Guffa Feb 24 '15 at 23:37

score 1 · Answer 7 · answered Sep 21 '12 at 12:35

There IS A POINT in introducing MAX_FILE_SIZE client side hidden form field.

php.ini can limit uploaded file size. So, while your script honors the limit imposed by php.ini, different HTML forms can further limit an uploaded file size. So, when uploading video, form may limit* maximum size to 10MB, and while uploading photos, forms may put a limit of just 1mb. And at the same time, the maximum limit can be set in php.ini to suppose 10mb to allow all this.

Although this is not a fool proof way of telling the server what to do, yet it can be helpful.

HTML does'nt limit anything. It just forwards the server all form variable including MAX_FILE_SIZE and its value.

Hope it helped someone.

The server should know by itself what to do, shouldn't it? – NoDataDumpNoContribution Feb 24 '15 at 20:06 — NoDataDumpNoContribution, Feb 24 '15 at 20:06

HTML Upload MAX_FILE_SIZE does not appear to work

7 Answers7

Update 1

Update 2

Linked

Related