Analyzing the Principle of Uploading Large Files in PHP

Analyzing the Principle of Uploading Large Files in PHP_PHP Tutorial

WBOY

Release： 2016-07-15 13:27:04

Original

783 people have browsed it

PHP has brought me more convenient programming, but we may encounter problems when using it. Let’s talk about the small problem of uploading large files with PHP. Due to the security issues involved in both local and server aspects, page file upload based on input type="file" has always been in an awkward position. On the one hand, users do not want their privacy to be leaked, so the browser cannot make effective judgments on the files selected by the user when uploading. On the other hand, for the sake of server-side security and reducing the transmission burden, the system hopes to reject illegal files before users start uploading.

Over time, uploading based on the original input method has become a legacy problem that network storage websites avoid, and it has also created all kinds of strange plug-ins and upload clients. Is the input method of uploading so bad? Of course not. When uploading files is not large, it is still very simple and reliable. In PHP, we only need a composite form.

<ol class="dp-xml">
<li class="alt">
<span><strong><font color="#006699"><span class="tag"><</SPAN><SPAN class=tag-name>form</SPAN></FONT></STRONG><SPAN> </SPAN><SPAN class=attribute><FONT color=#ff0000>enctype</FONT></SPAN><SPAN>=</SPAN><SPAN class=attribute-value><FONT color=#0000ff>"multipart/form-data"</FONT></SPAN><SPAN> </SPAN><SPAN class=attribute><FONT color=#ff0000>action</FONT></SPAN><SPAN>=</SPAN><SPAN class=attribute-value><FONT color=#0000ff>"__URL__"</FONT></SPAN><SPAN> </SPAN><SPAN class=attribute><FONT color=#ff0000>method</FONT></SPAN><SPAN>=</SPAN><SPAN class=attribute-value><FONT color=#0000ff>"POST"</FONT></SPAN><SPAN class=tag><STRONG><FONT color=#006699>></span></font></strong></span><span> </span>
</li>
<li class=""><span>一个输入框  </span></li>
<li class="alt">
<span></span><strong><font color="#006699"><span class="tag"><</SPAN><SPAN class=tag-name>input</SPAN></FONT></STRONG><SPAN> </SPAN><SPAN class=attribute><FONT color=#ff0000>name</FONT></SPAN><SPAN>=</SPAN><SPAN class=attribute-value><FONT color=#0000ff>"userfile"</FONT></SPAN><SPAN> </SPAN><SPAN class=attribute><FONT color=#ff0000>type</FONT></SPAN><SPAN>=</SPAN><SPAN class=attribute-value><FONT color=#0000ff>"file"</FONT></SPAN><SPAN> </SPAN><SPAN class=tag><STRONG><FONT color=#006699>/></span></font></strong><span> </span>
</li>
<li class=""><span>和服务器端的一行代码  </span></li>
<li class="alt"><span>move_uploaded_file($_FILES['userfile']['tmp_name'], '/var/www/uploads/'. basename($_FILES['userfile']['name'])); </span></li>
</ol>

Copy after login

can realize the entire upload process. But as the file grows, the shortcomings of form upload will be exposed. In particular, our simple idea of getting a minimum file size to prevent PHP from uploading large files has become so difficult. Let’s go through them one by one: Pass MAX_FILE_SIZ. We often read in the manual:

MAX_FILE_SIZE hidden field (unit: bytes) must be placed before the file input field, its value is the received file Maximum size. This is a recommendation for browsers, PHP also checks this. This setting can be easily bypassed on the browser side, so don't expect to use this feature to block large files. In fact, the maximum upload file size in PHP settings will not expire. But it is better to add this item to the form, because it can avoid the trouble of users spending time waiting for large files to be uploaded only to find that the file is too large and the upload failed.

Obviously PHP developers have also considered the problem of PHP uploading large files, but as the manual says, MAX_FILE_SIZE is just a suggestion for browsers. In fact, all mainstream browsers have not adopted it so far. This suggestion, so using MAX_FILE_SIZE to limit the file size is just like a decoration and is not feasible.

Through the server side

Since MAX_FILE_SIZE is invalid, the user can upload the file to the server, and the server side judges it through $_FILES['userfile']['size'] The size of the file uploaded by the user, and then decides whether to accept the upload and return the information. Excluding the load on the server and possible malicious sabotage for the time being, this solution sounds like nothing more than a waste of bandwidth, and it also restricts users from uploading files. But this is also not feasible. PHP file upload is affected by the following settings in php.ini:

<ol class="dp-xml">
<li class="alt"><span><span>post_max_size  </span></span></li>
<li class=""><span>upload_max_filesize  </span></li>
<li class="alt"><span>max_execution_time  </span></li>
<li class=""><span>memory_limit </span></li>
</ol>

Copy after login

Although the setting method is explained in detail in the manual, the reason why this method is still said to be unfeasible OK, because when the PHP execution script exceeds the memory_limit, all the POST data will be lost and no error will be reported! Imagine that the user fills out a very long form and uploads it along with a file that exceeds the memory_limit. After a long waiting time, he finds that what he is waiting for is another clean blank form. What an impressive user experience it is. ah. What's more, dozens of Mbytes of server traffic are only used to detect file sizes, which is not allowed in the current network environment.