25

I am getting a new php warning when a POST data from a form on my page to my server. The warning is as follows:

PHP Warning: Unknown: Input variables exceeded 1000. To increase the limit change max_input_vars in php.ini. in Unknown on line 0, referer: https://mywebsite.com/index.php

The thing is that my form does not have near 1000 input variables, so I am baffled as to why this is appearing. As a side note, I have not had this problem until recently and I suspect that when I ran yum update something changed/was installed that is causing this. Any advice or answers are appreciated.

EDIT 1: So I did var_dump($_REQUEST) and got ~1000 single character strings. The first couple items in the array are what they should be, but then a bunch of stuff that I don't need submitted is broken down into single character strings. Thoughts welcome.

array(1001) { 
    ["action"]=> string(10) "step1_show" 
    ["submit"]=> string(6) "Step 1" 
    [0]=> string(1) "a" 
    [1]=> string(1) "c" 
    [2]=> string(1) "t" 
    [3]=> string(1) "i" 
    [4]=> string(1) "o" 
    [5]=> string(1) "n" 
    [6]=> string(1) "=" 
    [7]=> string(1) "l" 
    [8]=> string(1) "o" 
    [9]=> string(1) "g" 
    [10]=> string(1) "o" 
    [11]=> string(1) "u" 
    [12]=> string(1) "t" 
    [13]=> string(1) "&" 
    [14]=> string(1) "p" 
    [15]=> string(1) "r" 
    [16]=> string(1) "o" 
    [17]=> string(1) "p" 
    [18]=> string(1) "e" 
    [19]=> string(1) "r" 
    [20]=> string(1) "t" 
    [21]=> string(1) "y" 
    [22]=> string(1) "=" 
    [23]=> string(1) "3" 
    [24]=> string(1) "7" 
    [25]=> .....     

ANSWER: It ended up being a problem with my submit handler. Thanks all for your input.

6
  • 2
    We'd need to see your form to be able to help.
    – DanRedux
    Mar 12, 2012 at 19:58
  • 1
    This feature was introduced in PHP 5.3.something. Can you show your form?
    – Pekka
    Mar 12, 2012 at 19:59
  • 1
    as above + what is max_input_vars set to?
    – user557846
    Mar 12, 2012 at 19:59
  • 1
    inspect the post request - you can see it in firebug or chrome's network tab Mar 12, 2012 at 19:59
  • 1
    My guess is that we are talking about an array mishap from JavaScript or HTML, like $.post({data: crazyobjecttomany}) or <input param="name[]">. But you need to dump the $_REQUEST var to find out for sure.
    – Xeoncross
    Mar 12, 2012 at 20:08

4 Answers 4

45

That's a new setting / value in PHP (related to a security update to prevent attacks to PHP scripts), so you get this after the update (before PHP 5.3.9 not set/available, suhosin users have a similar thing since ages).

Input values are of different kinds and array members count as well. So it's not enough to count form fields but also to take a look into the URL and other places related to input ($_GET, $_POST, $_SERVER, $_ENV, $_FILES, $_COOKIE ...).

See max_input_vars:

How many input variables may be accepted. Use of this directive mitigates the possibility of denial of service attacks which use hash collisions. If there are more input variables than specified by this directive, an E_WARNING is issued, and further input variables are truncated from the request. This limit applies only to each nesting level of a multi-dimensional input array.

2
  • 1
    Got it. Looks like the issue is I am posting items to the server that are not relevant to the particular form. Looking at the post request @Darhazer in firebug shows some issues. Thanks
    – Jon
    Mar 12, 2012 at 21:24
  • Quality control through PHP upgrade - funny ;) Glad you found the culprit.
    – hakre
    Mar 12, 2012 at 22:14
2

There is two way to solve this problem.

.htaccess

php_value max_input_vars 10000

php

ini_set('max_input_vars','10000' );
1

I was on my mac machine using Laravel valet... did followings to fix the error.

  1. On terminal php --ini to find out loaded PHP configuration file.
  2. sudo nano that file, in my case it was sudo nano /usr/local/etc/php/7.3/php.ini
  3. ctrl + w to search max_input_vars
    • In my case it was ;max_input_vars = 1000
    • Updated to max_input_vars = 2000
    • Save file.
  4. valet restart to update new configuration.
  5. That worked :-)
0
-1

I fixed the max_input_vars issue via my web host admin panel (Littleoak) I changed the max_input_vars = 0 to max_input_vars = 6000. There are several installations of php on my server that the server company configured. I believe the max_input_vars = 0 is to prevent email spammers from using the server to send spam. The php.ini file lives somewhere, not sure where, but I was able to modify it via the cPanel on my site admin.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.