Saturday, September 3, 2011

PHP POST variables getting truncated? Check suhosin

I worked on an issue lately where input from a textarea was getting truncated before it reached the PHP $_REQUEST or $_POST variables. The solution was simple, but it took me way too long to figure out, so maybe this will help somebody from Google one day. 


The site I had this problem with used php-cgi and nginx to serve requests. The the first things I checked where configurations in php.ini and nginx.conf (and other included nginx config files).
  • php.ini  - make sure post_max_size is high enough.  Mine was set to 8M, which seems to be common.
  • nginx.conf - client_max_body_size should also be enough.  This parameter is the maximum number of bytes a client can send to the server per request (I don't think this includes a file upload, may be wrong).
My problem was with suhosin.  Since I wasn't the original architect of this system, I knew nothing about this module.  It is described to "protect servers and users from known and unknown flaws in PHP applications and the PHP core".  


The problem was that the suhosin post.max_value_length parameter wasn't high enough.  By, default, it is 65000 (~63 KB).  I added this parameter to in my .ini config with a high-enough value, restarted php-cgi, and all was good.

1 comment:

  1. I'v found more general solution here: http://forums.phpfreaks.com/topic/138796-solved-post-array-size-limit-but-not-mb/
    It works on my host. I redefined some suhosin's and php's variables in my ini:
    suhosin.post.max_value_length = 67108864
    suhosin.post.max_vars = 10000
    suhosin.request.max_vars = 10000
    max_input_vars = 10000

    ReplyDelete