I am looking into php's max_input_vars setting
How many input variables may be accepted (limit is applied to $_GET, $_POST and $_COOKIE superglobal separately). Use of this directive mitigates the possibility of denial of service attacks which use hash collisions. If there are more input variables than specified by this directive, an E_WARNING is issued, and further input variables are truncated from the request.
Basically I understand that this limits the amount of variables someone can send with POST/GET and truncates them if more are given (with warning raised).
What stays unclear is how someone can use post parameters to create
the possibility of denial of service attacks which use hash collisions
Also does it make sense to substantially decrease the number there. If for example in my application I never use more than 20
POST variables, can I change
max_input_vars to say 30? If so, what improvements will I get?
If it makes a difference, I am using
php 5.5.10 on apache