120

I'm getting a max_input_vars error message.

I understand there's a php.ini setting that can change this starting with version 5.3.9 however, I'm running version 5.1.6.

When I view the configuration information for my 5.1.6 server it shows max_input_vars value is 1000.

My question is: Even though I'm running 5.1.6, I see this setting from phpinfo() but it's not in the php.ini file. Does this mean that the value is hard coded in this version of PHP and can't be changed?

Improve this question
9
  • 2
    I don't see any reference to max_input_vars at all in the PHP 5.1.6 source code so I'm not sure how you are seeing it in phpinfo() output. As far as I know, it didn't exist before 5.3.9... Commented Apr 24, 2012 at 18:31
  • 2
    Many parameters have defaults that are hard-coded, but you can still assign a new value. The fact that something isn't explicitly set in php.ini doesn't mean you can't use php.ini to change it. Commented Apr 24, 2012 at 18:51
  • 1
    Which error message do you get? Please add it to your question. Commented Apr 24, 2012 at 19:23
  • It is still not clear if there is a limit like max_input_vars in versions before 5.3.9? Commented Sep 27, 2013 at 4:32
  • I ran into this error after upgrading from 5.1.6 -> 5.3.3, then downgrading back to 5.1.6. Threw me because that option doesn't exist in the 5.1.6 php.ini file. I added the line, bumped up the number, and my error/issue went away. Commented Oct 22, 2014 at 20:56

14 Answers 14

Reset to default
126

Reference on PHP net:

http://php.net/manual/en/info.configuration.php#ini.max-input-vars

Please note, you cannot set this directive in run-time with function ini_set(name, newValue), e.g.

ini_set('max_input_vars', 3000);

It will not work.

As explained in documentation, this directive may only be set per directory scope, which means via .htaccess file, httpd.conf or .user.ini (since PHP 5.3).

See http://php.net/manual/en/configuration.changes.modes.php

Adding the directive into php.ini or placing following lines into .htaccess will work:

php_value max_input_vars 3000
php_value suhosin.get.max_vars 3000
php_value suhosin.post.max_vars 3000
php_value suhosin.request.max_vars 3000
Improve this answer
Sign up to request clarification or add additional context in comments.

5 Comments

Or placing all 3 suhosin directives on php.ini is ok.
If you have access to php.ini, the directive syntax is max_input_vars = 3000 (+ equal sign).
@shorif2000 I had similar problem in IIS, PHP 7 w/ wincache, using .user.ini file. First problem was cache. I moved the lines around in random order, in .user.ini until it finally worked. Second problem, changing 1000 to 2000 had no effect, but when I moved the entire line to a different line, then it worked.
This works for Apache running PHP as a module. Other web servers or Apache configurations might not use/read/understand .htaccess, so the best choice might be placing those directives inside .user.ini (unless that is also blocked...).
Just a note - if you are using a fcgi handler, php_value in .htaccess won't work. You need to use SetEnv directive then, like this: SetEnv php_value "max_input_vars=5000"
55

You can add it to php.ini and it should work - just tested it on PHP 5.3.6.

Improve this answer

3 Comments

Thanks, that's worth knowing, although I'm on 5.3.3 and no joy.
thanks for that obvious pointer, seriously - I was looking for this setting for an hour....until i saw this, add it dummy!
@Vaughany Do note that if you are on the bitnami stack then you will have to restart the php-fpm in case you are using it. Simply restarting apache will not help and may not even be required after making a change to /opt/bitnami/php/etc/php.ini
22

Have just attempted this fix with 5.3.3 and there's no change. Googling around I found this web page http://anothersysadmin.wordpress.com/2012/02/16/php-5-3-max_input_vars-and-big-forms/ detailing other settings which need changing if your server uses the Suhosin patch which Apache under Debian does.

The site explains:

So, if you want to increase this number to, say, 3000 from the default number which is 1000, you have to put in your php.ini these lines:

max_input_vars = 3000 suhosin.post.max_vars = 3000 suhosin.request.max_vars = 3000

I tested it (added settings to php.ini both in /etc/php5/apache2 and /etc/php5/cli, and restarted Apache successfully) but still no max_input_vars variable in phpinfo.

A few sites point to PHP 5.3.9 as the first PHP version in which this change will take, so my fault for not RTM properly in the first place, although I'm interested to see people reporting it working in version above 5.3.3 but below 5.3.9.

Improve this answer

1 Comment

Thankfully, recent versions of PHP (7.3+) got rid of the Suhosin patch (designed for PHP 5+), or, more precisely, whatever was being patched via Suhosin is not part of 'mainline' PHP. There is now Suhosin-NG, though.
17

It's 2018 now.And I just got stuck on this problem when I must send a request that exceeds the max_input_vars. And I came up with a solution that newie like me forgot to restart php fpm service after changing the max_input_vars param. because I only tried to restart apache2 service, but not php fpm

  1. uncomment code at /etc/php/7.0/fpm/php.ini and set number as you wish
    max_input_vars = 4000
  2. restart php fpm service, as I use php 7. Therefore,
    sudo service php7.0-fpm restart

Hope it helps
Tested on Debian Stretch, php7.0

Improve this answer

2 Comments

I wasted a full day trying to figure out how to make sure changes are applied and read so many solutions. They all mentioned after making changes to php.ini you should restart apache, which didn't make a difference. Restarting php7.2-fpm as noted in this solution solved the problem!
Just for the record: modern installations of Apache will usually not launch PHP from an embedded module — as has been the practice for decades — but rather from a separate FastCGI process, usually phpX.Y-fpm. This is consistent to how PHP has always worked under nginx and is generally considered the 'best' option these days (there are, of course, edge cases when it may make sense to keep a module inside Apache — but those exceptions are becoming rare...)
9

You need to uncomment max_input_vars value in php.ini file and increase it (exp. 2000), also dont forget to restart your server this will help for 99,99%.

Improve this answer

3 Comments

This did not work for me on Ubuntu 12.04. Set it to 3000 and used sudo service apache2 restart. Do I need to restart Ubuntu?
@motorbaby, If you had this value commented in php.ini, then you only had uncomment and restart services. Restart OS is not needed, but could be done, but I don't see any sense in this. If you didn't have it, then use @ lubosdz solution. If both will not help, then check if you are doing changes in right place, for example somehow you have several php.ini files. Also you can try just usage of "sudo service apache2 reload" for reloading configurations
The line was there. I removed ; and changed the value to 3000. The problem was likely the browser's cache. Closed PHPMyAdmin and opened in a new tab and it now works. Thanks!
6

Put this line on .htaccess file of your site

php_value max_input_vars 6000
Improve this answer

1 Comment

... if you're using Apache, of course; other web servers use different conventions.
5

Use of this directive mitigates the possibility of denial of service attacks which use hash collisions. If there are more input variables than specified by this directive, an E_WARNING is issued, and further input variables are truncated from the request.

I can suggest not to extend the default value which is 1000 and extend the application functionality by serialising the request or send the request by blocks. Otherwise, you can extend this to configuration needed.

It definitely needs to set up in the php.ini

Improve this answer

Comments

3

Note that you must put this in the file ".user.ini" in Centos7 rather than "php.ini" which used to work in Centos6. You can put ".user.ini" in any subdirectory in order to affect only that directory.

.user.ini :

max_input_vars = 3000

Tested on Centos7 and PHP 5.6.33.

Improve this answer

Comments

2

Just had the same problem adding menu items to Wordpress. I am using Wordpress 4.9.9 on Ubuntu 18.04, PHP 7.0. I simply uncommented the following line and increased it to 1500 in /etc/php/7.0/apache2/php.ini

; How many GET/POST/COOKIE input variables may be accepted<br>
max_input_vars = 1500

Then used the following to effect the change:

sudo apache2ctl configtest  #(if it does not return ok Apache will not start)
sudo service apache2 reload

Hope that helps.

Improve this answer

Comments

2

"PHP message: PHP Warning: Unknown: Input variables exceeded 1000. To increase the limit change max_input_vars in php.ini.

This php configuration parameter max_input_vars will affect not only your GET / POST / COOKIES parameters it also controls your any Form Input.

To set or change its value follow the below steps.

1) check the existing setting / value by viewing it in your php.ini file Locate php.ini file by using

<?php echo getinfo(); ?>

find below key: Loaded Configuration File : /etc/php/5.6/fpm/php.ini

2) Open the php.ini file in editable mode and do search for max_input_vars This line may be commented in your existing default setting with default value of 1000 , So remove ; to uncomment it and Edit it with your suitable value e.g. 2500.

3) Save the file and Restart the Services of PHP by using below sudo service php5.6-fpm restart

Similarly you can update any other similar PHP Configuration to your ease.

Improve this answer

Comments

1

Just to complement. On a shared server using mod_suphp I was having the same issue.

Declaring 4 max_input_vars (suhosin included), didn't solved it, it just kept truncating on 1000 vars (default), and declaring "php_value max_input_vars 6000" on .htaccess threw error 500.

What solved it was to add the following on .htaccess, which applies the php.ini file recursively to that path

suPHP_ConfigPath /home/myuser/public_html
Improve this answer

Comments

1

If you are using something like wodby (docker4php or docker4drupal) or lando or trying to find an answer "why php.ini doesn't work" (like me), these tools are using their own way to pass configuration into php

https://github.com/wodby/php#php-and-php-fpm-configuration

I was trying to set max_input_vars, in wodby+docker-compose you do it like so

  php:
    image: wodby/drupal-php:$PHP_TAG
    container_name: "${PROJECT_NAME}_php"
    environment:
      PHP_MAX_INPUT_VARS: 9999
Improve this answer

Comments

0

New Cpanels block to see the .htaccess file or if you add a .user.ini you wont be able to see it. but with a little hack you can make it work. Edit for example wp-config.php and in the URL bar replace wp-config.php by .htaccess now you can paste the values and save it. enter image description here

Improve this answer

Comments

-6

Yes, add it to the php.ini, restart apache and it should work.

You can test it on the fly if you want to with ini_set("max_input_vars",100)

Improve this answer

3 Comments

This will not work, see php.net/manual/en/info.configuration.php. Must be set per directory virtual host or htaccess, not ini_set.
We can set this variable through ini_set function. Why this answer got down votes? php.net/manual/en/info.configuration.php
@Ahmad because actually you cannot change it via ini_set(). If you look closely at that page, you'll see that max_input_vars is flagged as PHP_INI_PERDIR — which means Entry can be set in php.ini, .htaccess, httpd.conf or .user.ini — thus, setting it via ini_set() is not allowed!

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.