HTML Upload MAX_FILE_SIZE does not appear to work

user_637041 0
Viewed 139871

I am wondering how is the hidden field named MAX_FILE_SIZE supposed to work?

<form action="" method="post" enctype="multipart/form-data">
    <!-- in byes must preceed file field -->
    <input type="hidden" name="MAX_FILE_SIZE" value="2097152" /> 
    <input type="file" name="upload" />

    <input type="submit" name="submit" value="Submit" />
</form>

I uploaded a 4MB+ file but I got no warning from client side (I am not talking about server side). What is it MAX_FILE_SIZE supposed to do?

UPDATE

OK so its for PHP to impose a "soft" limit. But is there any difference between using it and checking something like $_FILES['upload']['size'] < 2000 in code?

file-upload html php
7 Answers

Before I start, please let me emphasize that the size of the file must be checked on the server side. If not checked on server side, malicious users can override your client side limits, and upload huge files to your server. DO NOT TRUST THE USERS.

I played a bit with PHP's MAX_FILE_SIZE, it seemed to work only after the file was uploaded, which makes it irrelevant (again, malicious user can override it quite easily).

The javascript code below (tested in Firefox and Chrome), based on Matthew's post, will warn the user (the good, innocent one) a priori to uploading a large file, saving both traffic and the user's time:

<form method="post" enctype="multipart/form-data" 
onsubmit="return checkSize(2097152)">    
<input type="file" id="upload" />
<input type="submit" />


<script type="text/javascript">
function checkSize(max_img_size)
{
    var input = document.getElementById("upload");
    // check for browser support (may need to be modified)
    if(input.files && input.files.length == 1)
    {           
        if (input.files[0].size > max_img_size) 
        {
            alert("The file must be less than " + (max_img_size/1024/1024) + "MB");
            return false;
        }
    }

    return true;
}
</script>
user_12830630
Related