Considering a site that handles large POST data, would it be unreasonable and dangerous to set the php.ini max_input_vars to something like 100000?

I know this is a vector for DOS attacks, but don't other configurations such as post_max_size help to prevent that? Are there any ways to safeguard against hash collisions while still having max_input_vars set at a high value?

Other considerations would be the effect on GET and cookies. Can someone please explain the consequences of this configuration and the exploits involved?

1 Answer 1


The vulnerability is about hash collisions and not necessary about the size of the request.

So yes setting the directive to a higher value is probably not a smart idea (even when you are limiting the post_max_size or any of the other related directives).

Also if you need to set it to something like 100000 you should really reconsider what you are doing in most cases.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .