PHP's File Uploading Limits....

[nicoleblack]

I have some scripts on a new website that allow people to upload photos. These days, photos are so large, these upload scripts absolutely LAUGH at php's default 2MB upload_max_filesize limit.

It is not out of the ordinary for people to want to upload 100-200mb of photos with each post in my scripts. I know I can allow this by putting the following in each .htaccess for each script's directory:

php_value max_execution_time 200
php_value upload_max_filesize 175M
php_value post_max_size 200M
php_value memory_limit 100M

So my question is:

Is this acceptable? Is it acceptable on the security front? And is it acceptable on the performance front? What is one to do in a situation like mine where I want my users to be able to upload 5-10 full resolution photos?

NOTE: Due to time constraints... I cannot utilize FTP to upload these photos. I need to stick with php's built-in file uploading $_FILE method. Thanks for your help.
http://www.infysolutions.com

Outsourcing software development

[guideseeq]

FTP to upload photos is good but you're planning not to do so. HTTP file upload is slow for slow Internet connection. If your clientele is suppose US, then they have fast Internet connections.

About security, you've to take care. Basically, increasing execution time and memory limit means you must be sure about safety of every script executing in your Web server via your application. I think, security won't be an issue if we do through testing of our application. For obvious reasons, we need high values of execution time and memory limit. Other possibility and niche is to launch backend programs (I didn't came across yet) called from PHP scripts which would be doing actual file upload so execution time or memory consumption of PHP script from HTTP client can be kept low.

I may suggest to look into some project there at sourceforge.net Web site.