PHP Warning: Unknown: Input variables exceeded 1000

Question

I am getting a new php warning when a POST data from a form on my page to my server. The warning is as follows:

PHP Warning: Unknown: Input variables exceeded 1000. To increase the limit change max_input_vars in php.ini. in Unknown on line 0, referer: https://mywebsite.com/index.php

The thing is that my form does not have near 1000 input variables, so I am baffled as to why this is appearing. As a side note, I have not had this problem until recently and I suspect that when I ran yum update something changed/was installed that is causing this. Any advice or answers are appreciated.

EDIT 1: So I did var_dump($_REQUEST) and got ~1000 single character strings. The first couple items in the array are what they should be, but then a bunch of stuff that I don't need submitted is broken down into single character strings. Thoughts welcome.

array(1001) { 
    ["action"]=> string(10) "step1_show" 
    ["submit"]=> string(6) "Step 1" 
    [0]=> string(1) "a" 
    [1]=> string(1) "c" 
    [2]=> string(1) "t" 
    [3]=> string(1) "i" 
    [4]=> string(1) "o" 
    [5]=> string(1) "n" 
    [6]=> string(1) "=" 
    [7]=> string(1) "l" 
    [8]=> string(1) "o" 
    [9]=> string(1) "g" 
    [10]=> string(1) "o" 
    [11]=> string(1) "u" 
    [12]=> string(1) "t" 
    [13]=> string(1) "&" 
    [14]=> string(1) "p" 
    [15]=> string(1) "r" 
    [16]=> string(1) "o" 
    [17]=> string(1) "p" 
    [18]=> string(1) "e" 
    [19]=> string(1) "r" 
    [20]=> string(1) "t" 
    [21]=> string(1) "y" 
    [22]=> string(1) "=" 
    [23]=> string(1) "3" 
    [24]=> string(1) "7" 
    [25]=> .....

ANSWER: It ended up being a problem with my submit handler. Thanks all for your input.

This feature was introduced in PHP 5.3.something. Can you show your form? — Pekka, Mar 12 '12 at 19:59
inspect the post request - you can see it in firebug or chrome's network tab — Maxim Krizhanovsky, Mar 12 '12 at 19:59
My guess is that we are talking about an array mishap from JavaScript or HTML, like `$.post({data: crazyobjecttomany})` or ``. But you need to dump the `$_REQUEST` var to find out for sure. — Xeoncross, Mar 12 '12 at 20:08
By me, the problem was the following: I had a client that sent me POST request to my web server which handled the request. So that client didn't empty its array (bug) so I received more and more same data, including new ones. That was the reason for this warning. As I came on your post, it was clear for me what was wrong. I also edited my web server PHP script so that it makes free memory AFTER the request is done. Setting the variables with big data to NULL. — Peter, Mar 17 '16 at 07:27

hakre · Accepted Answer · 2012-03-12T20:09:50.483

That's a new setting / value in PHP (related to a security update to prevent attacks to PHP scripts), so you get this after the update (before PHP 5.3.9 not set/available, suhosin users have a similar thing since ages).

Input values are of different kinds and array members count as well. So it's not enough to count form fields but also to take a look into the URL and other places related to input ($_GET, $_POST, $_SERVER, $_ENV, $_FILES, $_COOKIE ...).

See max_input_vars:

How many input variables may be accepted. Use of this directive mitigates the possibility of denial of service attacks which use hash collisions. If there are more input variables than specified by this directive, an E_WARNING is issued, and further input variables are truncated from the request. This limit applies only to each nesting level of a multi-dimensional input array.

Got it. Looks like the issue is I am posting items to the server that are not relevant to the particular form. Looking at the post request @Darhazer in firebug shows some issues. Thanks — Jon, Mar 12 '12 at 21:24
Quality control through PHP upgrade - funny ;) Glad you found the culprit. — hakre, Mar 12 '12 at 22:14

score 2 · Answer 2 · answered Feb 29 '20 at 10:49

2

There is two way to solve this problem.

.htaccess

php_value max_input_vars 10000

php

ini_set('max_input_vars','10000' );

answered Feb 29 '20 at 10:49

Himal Majumder

21
1
3

score 1 · Answer 3 · answered Jul 11 '20 at 13:26

I was on my mac machine using Laravel valet... did followings to fix the error.

On terminal php --ini to find out loaded PHP configuration file.
sudo nano that file, in my case it was sudo nano /usr/local/etc/php/7.3/php.ini
ctrl + w to search max_input_vars
- In my case it was ;max_input_vars = 1000
- Updated to max_input_vars = 2000
- Save file.
valet restart to update new configuration.
That worked :-)

score -1 · Answer 4 · edited Jun 10 '16 at 17:44

I fixed the max_input_vars issue via my web host admin panel (Littleoak) I changed the max_input_vars = 0 to max_input_vars = 6000. There are several installations of php on my server that the server company configured. I believe the max_input_vars = 0 is to prevent email spammers from using the server to send spam. The php.ini file lives somewhere, not sure where, but I was able to modify it via the cPanel on my site admin.

PHP Warning: Unknown: Input variables exceeded 1000

4 Answers4

Linked

Related