允许用户从URL保存文件的安全问题

Question

I'm developing a script to grab small sized files (less than 1 MB) from user given a URLs and save them on my server.

My main concern is what if someone tried to upload large files like 1 GB files or even bigger? How do I control the file grabbing if it is a large file?

I tried some of the answers on the web but all of them process the whole file. For a 700 MB video file, it took couple of minutes, does that mean the process taking my server resources?

What if a hacker keep posting URLs to large files so those process will eat up my server resources and I will loose visitors.

Can someone advice me on this?

Answer 1

This should do the trick. No file bigger than 1 megabyte can be uploaded

if($_FILES['file']['size'] < 1048576) { // This is one megabyte (in bytes)
    // the file is within size restriction, continue
} else {
    // File is too large, return an error
}

Then you could use some javascript to test the file size before upload, but just remember you can't rely on it for security.