PHP file size detection and large file upload processing

Due to the security issues involved in both local and server aspects, page file upload based on input type="file" has always been in an awkward position. On the one hand, users do not want their privacy to be leaked, so the browser cannot make effective judgments on the files selected by the user when uploading. On the other hand, for the sake of server-side security and reducing the transmission burden, the system hopes to reject illegal files before users start uploading.

Over time, uploading based on the original input method has become a legacy problem that network storage websites avoid, and it has also created all kinds of strange plug-ins and upload clients.

Is the input method of uploading so bad? of course not. When uploading files is not large, it is still very simple and reliable. In PHP, we only need a composite form:

<form enctype="multipart/form-data" action="__URL__" method="POST">

an input box:

<input name="userfile" type="file" />

and a line of code on the server side:

move_uploaded_file($_FILES['userfile']['tmp_name'], '/var/www/uploads/'. basename($_FILES['userfile']['name']));

to complete the entire upload process.

But as the file grows, the shortcomings of form upload will be exposed. In particular, the simple idea of ​​getting to a minimum file size to prevent overly large file uploads has become so difficult. Let’s go through them one by one:

By MAX_FILE_SIZE

MAX_FILE_SIZE The hidden field (in bytes) must be placed before the file input field, and its value is the maximum size of the received file. This is a recommendation for browsers, PHP also checks this. This setting can be easily bypassed on the browser side, so don't expect to use this feature to block large files. In fact, the maximum upload file size in PHP settings will not expire. But it is better to add this item to the form, because it can avoid the trouble of users spending time waiting for large files to be uploaded only to find that the file is too large and the upload failed.

Obviously PHP developers have also considered the issue of large file uploads, but as the manual says, MAX_FILE_SIZE is just a suggestion for browsers. In fact, all mainstream browsers so far have not adopted this suggestion, so use MAX_FILE_SIZE restricting the file size is just like an arrangement and is not feasible.

Through the server side

Since MAX_FILE_SIZE is invalid, the user can upload the file to the server. The server side uses $_FILES['userfile']['size'] to determine the size of the file uploaded by the user, and then decides whether to accept the upload and return the information . Excluding the load on the server and possible malicious sabotage for the time being, this solution sounds like nothing more than a waste of bandwidth, and it also restricts users from uploading files.

But this is also not feasible. PHP file upload is affected by the following settings in php.ini:

post_max_size
upload_max_filesize
max_execution_time
memory_limit

Although the setting method is explained in detail in the manual, the reason why this method is still not feasible is because When the PHP execution script exceeds memory_limit, all POST data will be lost and no error will be reported!

Imagine the user fills out a very long form and uploads it along with a file that exceeds the memory_limit. After a long waiting time, he finds that what he is waiting for is another clean blank form. How impressive is that? User experience. What's more, dozens of Mbytes of server traffic are only used to detect file sizes, which is not allowed in the current network environment.

Through Javascript

Javascript is based on the browser. Although JS can complete many seemingly impossible tasks, JS cannot do things that the browser cannot do. Inherent shortcomings doom this work to Javascript alone. However, some IE Only methods still exist, for reference only.

Through Flash

Flash’s FileReference class provides a relatively comprehensive set of file processing methods. Now most large file uploads also use Flash-based solutions. If Flash is used to interact with Js, can the client detect the file size? The answer is yes.

First instantiate the FileReference class in the flash file.

var fr = new FileReference();

Based on this class, you can use the file browse and SelectFile events provided by Flash to replace browser events. We need:

1. Bind SelectFile

fr.addEventListener(Event.SELECT, onSelectFile);

2. Create an object for Js access to place the file information obtained by flash

var s = {
    size:0,
    name:'',
    type:''
}

3. Create a file browse method

function browseFile():void {<br>
    fr.browse();<br>
}

4. When the SelectFile event is triggered When, pass the file information

function onSelectFile(e:Event):void {<br>
    s.size = fr.size;<br>
    s.name = fr.name;<br>
    s.type = fr.type;<br>
}

5. Make the browseFile method public for Js to call

ExternalInterface.addCallback("browseFile", browseFile);

6. Pass the obtained file information to Js

ExternalInterface.call("onSelectFile",s);

Now we can get the file size information passed by flash through Js , please refer to Demo for specific implementation.

Conclusion

The problem seems to have been solved so far. We have successfully verified the file size, right? But the final conclusion of this article is that Flash-based file size verification is still not feasible.

The only purpose of file size verification is for uploading. In the demo above, you can see that the file name that is successfully verified will be displayed in an input box. Don’t students who are familiar with uploading think something is missing? That's right, you can only get the file name through flash, but you can't get the full path of the file, and the file path is a necessary condition for uploading by input. So although we can successfully verify the file size through Flash and JS interaction, all we can do is just verify it. If we want to upload it later, we can only continue to use Flash.

It is understandable that Flash development blocks the full path of the file for security reasons. However, file upload, especially the file verification upload solution in the PHP environment, still does not have the best solution.

Of course there are many ways to make up for it:

Perl-based projects FileChucker,

But after all, I hope that one day I can see a rigorous and robust upload solution based on HTML alone. I hope this day is not too far away.

The last is this code download.

Detailed explanation of PHP file upload size setting

When uploading files with PHP, the most common problem is errors when uploading large files. This involves the php configuration file - php.ini

In this configuration file, there are several values ​​that are closely related to file uploads:

file_uploads = on //Whether the system is allowed to support file uploads

upload_tmp_dir //The storage path of temporary files, which is the system default path under Linux. It needs to be specified under win32

upload_max_filesize = 2m //The maximum size allowed for file upload

post_max_size = 2m //What PHP can accept when giving it to PHP through the post method The maximum data capacity

If the size of the file you upload is less than 8m (usually), then modifying the above settings can meet your requirements.

But if >8m, in addition to the above values, we need to pay special attention to the other two values:

max_execution_time = 30 //The maximum time for each script to be executed (when PHP is uploaded, the size is large, It’s just a matter of time)

memory_limit = 8m //The maximum memory that each script can consume

Try to change these two values ​​​​to be larger. Generally this can solve most problems.

It can be inferred from this that the size of the uploaded file can be infinite. But also consider your network situation, etc.