I am looking into php's max_input_vars setting

How many input variables may be accepted (limit is applied to $_GET, $_POST and $_COOKIE superglobal separately). Use of this directive mitigates the possibility of denial of service attacks which use hash collisions. If there are more input variables than specified by this directive, an E_WARNING is issued, and further input variables are truncated from the request.

Basically I understand that this limits the amount of variables someone can send with POST/GET and truncates them if more are given (with warning raised).

What stays unclear is how someone can use post parameters to create

the possibility of denial of service attacks which use hash collisions

Also does it make sense to substantially decrease the number there. If for example in my application I never use more than 20 POST variables, can I change max_input_vars to say 30? If so, what improvements will I get?

If it makes a difference, I am using php 5.5.10 on apache 2.4.7


1 Answer 1


I might be not as good in explaining the concept of an hash collision as good as this external doc so if it becomes not clear you can have a look at it.

In principle the POST and GET data is using a key-value structure. When receiving the data in a request and when accessing $_POST then php will need to convert the list given as a string which could look like this


into a form so taht you can do for instance this:

echo $_POST["EzEzEzEzEzEzEzEz"];

the string is not ideal to access the value, so that internally a hash-function is used to transform it to a resulting hash value. The problem and potential attack that max_input_vars could prevent is that related to the case that two keys generate the same hash-value hence a hash_collision, which causes extra time to care for such a coallision and would allow to use up lots of CPU with a rather simple HTTP request.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .