Bandwidth wasted when checking uploaded file?

Confessions

Just wondering if bandwidth is consumed when checking for an uploaded file using this:

if (($FILES["image"]["size"] < 20000) || ($FILES["image"]["name"] == NULL))

If someone happens to upload a 100 mb file, does it take that much bandwidth to check it?

Weedpacket

By the time that code runs, the file has already been uploaded.

Confessions

So there's no real solution to this? Seeing as a client sided restriction (if you can even make one that universally works) can be easily bypassed?

halojoy

http://www.php.net/manual/en/features.file-upload.post-method.php

<form enctype="multipart/form-data" action="__URL__" method="POST">
    <!-- MAX_FILE_SIZE must precede the file input field -->
    <input type="hidden" name="MAX_FILE_SIZE" value="30000" />
    <!-- Name of input element determines name in $_FILES array -->
    Send this file: <input name="userfile" type="file" />
    <input type="submit" value="Send File" />
</form>

The MAX_FILE_SIZE hidden field (measured in bytes) must precede the file input field, and its value is the maximum filesize accepted by PHP. This form element should always be used as it saves users the trouble of waiting for a big file being transferred only to find that it was too large and the transfer failed. Keep in mind: fooling this setting on the browser side is quite easy, so never rely on files with a greater size being blocked by this feature. It is merely a convenience feature for users on the client side of the application. The PHP settings (on the server side) for maximum-size, however, cannot be fooled.

So you can set MAX_FILE_SIZE to a value less or equal to the max upload file size setting in php.ini (use phpinfo() to find out max size).
Unless somebody is fooling with the upload script,
then no bigger files than MAX_FILE_SIZE will be transfered.

bradgrafelman

I've never seen a browser that actually pays attention to the MAX_FILE_SIZE element, so it's pretty much useless.

Confessions wrote:
So there's no real solution to this?

Not a strictly PHP/HTML one, no. Only way I can think of actually enforcing a client-side limit would be to use some sort of Java or Flash object that could determine the file's size before it's uploaded.

Weedpacket

For any sort of reliability the monitoring would have to be done server-side (because anything on the client can be bypass or simply not used). The mod_security module can be used with Apache to abort oversized requests and toss back the appropriate 413 response.