nerdexam
GIAC

GPEN · Question #40

What is the maximum limit of the file size that a user can upload according to the code snippet given below? <form enctype="multipart/form-data" action="index.php" method="post"> <input type="hidden"

The correct answer is C. 5,000 bytes. The MAX_FILE_SIZE hidden field value in an HTML form is interpreted in bytes, so a value of 5000 sets a 5,000-byte upload limit.

Web Application Penetration Testing

Question

What is the maximum limit of the file size that a user can upload according to the code snippet given below? <form enctype="multipart/form-data" action="index.php" method="post"> <input type="hidden" name="MAX_FILE_SIZE" value="5000? /> <input name="filedata" type="file" /> <input type="submit" value="Send file" /> </form>

Options

  • A5,000 Kilobytes
  • B5,000 Megabytes
  • C5,000 bytes
  • D5,000 bits

How the community answered

(33 responses)
  • A
    15% (5)
  • B
    9% (3)
  • C
    73% (24)
  • D
    3% (1)

Why each option

The MAX_FILE_SIZE hidden field value in an HTML form is interpreted in bytes, so a value of 5000 sets a 5,000-byte upload limit.

A5,000 Kilobytes

5,000 kilobytes would require a value of 5,120,000 in the field, since the unit is bytes not kilobytes.

B5,000 Megabytes

5,000 megabytes would require a value of 5,242,880,000, as the field unit is bytes not megabytes.

C5,000 bytesCorrect

PHP's file upload mechanism reads the MAX_FILE_SIZE hidden input value as plain bytes - no unit suffix is applied - so value='5000' instructs the client-side and server-side validation to reject files larger than 5,000 bytes, which is roughly 4.88 KB.

D5,000 bits

Web file sizes are measured in bytes not bits, and 5,000 bits would be only 625 bytes - the PHP MAX_FILE_SIZE field does not operate in bit units.

Concept tested: PHP HTML form MAX_FILE_SIZE hidden field unit interpretation

Source: https://www.php.net/manual/en/features.file-upload.post-method.php

Topics

#file upload#MAX_FILE_SIZE#HTML forms#web security

Community Discussion

No community discussion yet for this question.

Full GPEN Practice