77 files changed, 5522 insertions, 23 deletions

diff --git a/config.m4 b/config.m4
index a6dade9..23081dd 100644
--- a/config.m4
+++ b/config.m4
@@ -5,7 +5,7 @@ PHP_ARG_ENABLE(suhosin7, whether to enable suhosin support,
 [  --enable-suhosin7        Enable suhosin support])
 
 if test "$PHP_SUHOSIN7" != "no"; then
-        PHP_NEW_EXTENSION(suhosin7, suhosin7.c ifilter.c memory_limit.c aes.c treat_data.c log.c execute.c execute_ih.c execute_rnd.c crypt.c cookiecrypt.c header.c session.c, $ext_shared,, [-DZEND_ENABLE_STATIC_TSRMLS_CACHE=1])
+        PHP_NEW_EXTENSION(suhosin7, suhosin7.c ifilter.c memory_limit.c aes.c treat_data.c log.c execute.c execute_ih.c execute_rnd.c crypt.c cookiecrypt.c header.c session.c ex_imp.c rfc1867.c ufilter.c post_handler.c, $ext_shared,, [-DZEND_ENABLE_STATIC_TSRMLS_CACHE=1])
         PHP_ADD_EXTENSION_DEP(suhosin7, hash)
         echo "===== WARNING ============================================"
         echo "  Suhosin7 for PHP 7 is in alpha stage at the moment and"
@@ -29,7 +29,7 @@ fi
 
 AC_MSG_CHECKING([for C11 support with -std=c11])
 old_CFLAGS="$CFLAGS"
-CFLAGS+=" -std=c11"
+CFLAGS="${CFLAGS} -std=c11"
 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([],[])],[AC_MSG_RESULT([yes])],[
         AC_MSG_RESULT([no])
         CFLAGS="$old_CFLAGS"
@@ -38,7 +38,7 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([],[])],[AC_MSG_RESULT([yes])],[
         echo "  support. Trying C99 instead, but compiling may fail."
         echo "=========================================================="
         AC_MSG_CHECKING([for C99 support with -std=c99])
-        CFLAGS+=" -std=c99"
+        CFLAGS="${CFLAGS} -std=c99"
         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([],[])],[AC_MSG_RESULT([yes])],[
                 AC_MSG_RESULT([no])
                 CFLAGS="$old_CFLAGS"
diff --git a/ex_imp.c b/ex_imp.c
new file mode 100644
index 0000000..fd940ce
--- /dev/null
+++ b/ex_imp.c
@@ -0,0 +1,318 @@
+/*
+  +----------------------------------------------------------------------+
+  | Suhosin Version 1                                                    |
+  +----------------------------------------------------------------------+
+  | Copyright (c) 2006-2007 The Hardened-PHP Project                     |
+  | Copyright (c) 2007-2016 SektionEins GmbH                             |
+  +----------------------------------------------------------------------+
+  | This source file is subject to version 3.01 of the PHP license,      |
+  | that is bundled with this package in the file LICENSE, and is        |
+  | available through the world-wide-web at the following url:           |
+  | http://www.php.net/license/3_01.txt                                  |
+  | If you did not receive a copy of the PHP license and are unable to   |
+  | obtain it through the world-wide-web, please send a note to          |
+  | license@php.net so we can mail you a copy immediately.               |
+  +----------------------------------------------------------------------+
+  | Authors: Stefan Esser <sesser@sektioneins.de>                        |
+  |          Ben Fuhrmannek <ben.fuhrmannek@sektioneins.de>              |
+  +----------------------------------------------------------------------+
+
+  Note: The following code is based on ext/standard/array.c from PHP 7.
+  | Copyright (c) 1997-2016 The PHP Group                                |
+  Original PHP Version 7 Authors:
+  |          Andi Gutmans <andi@zend.com>                                |
+  |          Zeev Suraski <zeev@zend.com>                                |
+  |          Rasmus Lerdorf <rasmus@php.net>                             |
+  |          Andrei Zmievski <andrei@php.net>                            |
+  |          Stig Venaas <venaas@php.net>                                |
+  |          Jason Greene <jason@php.net>                                |
+
+*/
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "php.h"
+#include "php_ini.h"
+#include "ext/standard/php_smart_string.h"
+#include "ext/standard/php_var.h"
+#include "php_suhosin7.h"
+
+
+#define EXTR_OVERWRITE                  0
+#define EXTR_SKIP                               1
+#define EXTR_PREFIX_SAME                2
+#define EXTR_PREFIX_ALL                 3
+#define EXTR_PREFIX_INVALID             4
+#define EXTR_PREFIX_IF_EXISTS   5
+#define EXTR_IF_EXISTS                  6
+
+#define EXTR_REFS                               0x100
+
+
+static zend_always_inline int php_valid_var_name(char *var_name, size_t var_name_len) /* {{{ */
+{
+#if 1
+        /* first 256 bits for first character, and second 256 bits for the next */
+        static const uint32_t charset[16] = {
+             /*  31      0   63     32   95     64   127    96 */
+                        0x00000000, 0x00000000, 0x87fffffe, 0x07fffffe,
+                        0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff,
+             /*  31      0   63     32   95     64   127    96 */
+                        0x00000000, 0x03ff0000, 0x87fffffe, 0x07fffffe,
+                        0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff
+                };
+#endif
+        size_t i;
+        uint32_t ch;
+
+        if (UNEXPECTED(!var_name_len)) {
+                return 0;
+        }
+
+        /* These are allowed as first char: [a-zA-Z_\x7f-\xff] */
+        ch = (uint32_t)((unsigned char *)var_name)[0];
+#if 1
+        if (UNEXPECTED(!(charset[ch >> 5] & (1 << (ch & 0x1f))))) {
+#else
+        if (var_name[0] != '_' &&
+                (ch < 65  /* A    */ || /* Z    */ ch > 90)  &&
+                (ch < 97  /* a    */ || /* z    */ ch > 122) &&
+                (ch < 127 /* 0x7f */ || /* 0xff */ ch > 255)
+        ) {
+#endif
+                return 0;
+        }
+
+        /* And these as the rest: [a-zA-Z0-9_\x7f-\xff] */
+        if (var_name_len > 1) {
+                i = 1;
+                do {
+                        ch = (uint32_t)((unsigned char *)var_name)[i];
+#if 1
+                        if (UNEXPECTED(!(charset[8 + (ch >> 5)] & (1 << (ch & 0x1f))))) {
+#else
+                        if (var_name[i] != '_' &&
+                                (ch < 48  /* 0    */ || /* 9    */ ch > 57)  &&
+                                (ch < 65  /* A    */ || /* Z    */ ch > 90)  &&
+                                (ch < 97  /* a    */ || /* z    */ ch > 122) &&
+                                (ch < 127 /* 0x7f */ || /* 0xff */ ch > 255)
+                        ) {
+#endif
+                                return 0;
+                        }
+                } while (++i < var_name_len);
+        }
+
+        if (suhosin_is_protected_varname(var_name, var_name_len)) {
+                return 0;
+        }
+        
+        return 1;
+}
+
+/* {{{ proto int extract(array var_array [, int extract_type [, string prefix]])
+   Imports variables into symbol table from an array */
+PHP_FUNCTION(suhosin_extract)
+{
+        zval *var_array_param, *prefix = NULL;
+        zend_long extract_type = EXTR_OVERWRITE;
+        zval *entry;
+        zend_string *var_name;
+        zend_ulong num_key;
+        int var_exists, count = 0;
+        int extract_refs = 0;
+        zend_array *symbol_table;
+        zval var_array;
+
+#ifndef FAST_ZPP
+        if (zend_parse_parameters(ZEND_NUM_ARGS(), "a|lz/", &var_array_param, &extract_type, &prefix) == FAILURE) {
+                return;
+        }
+#else
+        ZEND_PARSE_PARAMETERS_START(1, 3)
+                Z_PARAM_ARRAY(var_array_param)
+                Z_PARAM_OPTIONAL
+                Z_PARAM_LONG(extract_type)
+                Z_PARAM_ZVAL_EX(prefix, 0, 1)
+        ZEND_PARSE_PARAMETERS_END();
+#endif
+
+        extract_refs = (extract_type & EXTR_REFS);
+        if (extract_refs) {
+                SEPARATE_ZVAL(var_array_param);
+        }
+        extract_type &= 0xff;
+
+        if (extract_type < EXTR_OVERWRITE || extract_type > EXTR_IF_EXISTS) {
+                php_error_docref(NULL, E_WARNING, "Invalid extract type");
+                return;
+        }
+
+        if (extract_type > EXTR_SKIP && extract_type <= EXTR_PREFIX_IF_EXISTS && ZEND_NUM_ARGS() < 3) {
+                php_error_docref(NULL, E_WARNING, "specified extract type requires the prefix parameter");
+                return;
+        }
+
+        if (prefix) {
+                convert_to_string(prefix);
+                if (Z_STRLEN_P(prefix) && !php_valid_var_name(Z_STRVAL_P(prefix), Z_STRLEN_P(prefix))) {
+                        php_error_docref(NULL, E_WARNING, "prefix is not a valid identifier");
+                        return;
+                }
+        }
+
+        symbol_table = zend_rebuild_symbol_table();
+#if 0
+        if (!symbol_table) {
+                php_error_docref(NULL, E_WARNING, "failed to build symbol table");
+                return;
+        }
+#endif
+
+        /* The array might be stored in a local variable that will be overwritten. To avoid losing the
+         * reference in that case we work on a copy. */
+        ZVAL_COPY(&var_array, var_array_param);
+
+        ZEND_HASH_FOREACH_KEY_VAL_IND(Z_ARRVAL(var_array), num_key, var_name, entry) {
+                zval final_name;
+
+                ZVAL_NULL(&final_name);
+                var_exists = 0;
+
+                if (var_name) {
+                        var_exists = zend_hash_exists_ind(symbol_table, var_name);
+                } else if (extract_type == EXTR_PREFIX_ALL || extract_type == EXTR_PREFIX_INVALID) {
+                        zend_string *str = zend_long_to_str(num_key);
+                        php_prefix_varname(&final_name, prefix, ZSTR_VAL(str), ZSTR_LEN(str), 1);
+                        zend_string_release(str);
+                } else {
+                        continue;
+                }
+
+                switch (extract_type) {
+                        case EXTR_IF_EXISTS:
+                                if (!var_exists) break;
+                                /* break omitted intentionally */
+
+                        case EXTR_OVERWRITE:
+                                /* GLOBALS protection */
+                                if (var_exists && ZSTR_LEN(var_name) == sizeof("GLOBALS")-1 && !strcmp(ZSTR_VAL(var_name), "GLOBALS")) {
+                                        break;
+                                }
+                                if (var_exists && ZSTR_LEN(var_name) == sizeof("this")-1  && !strcmp(ZSTR_VAL(var_name), "this") && EG(scope) && ZSTR_LEN(EG(scope)->name) != 0) {
+                                        break;
+                                }
+                                ZVAL_STR_COPY(&final_name, var_name);
+                                break;
+
+                        case EXTR_PREFIX_IF_EXISTS:
+                                if (var_exists) {
+                                        php_prefix_varname(&final_name, prefix, ZSTR_VAL(var_name), ZSTR_LEN(var_name), 1);
+                                }
+                                break;
+
+                        case EXTR_PREFIX_SAME:
+                                if (!var_exists && ZSTR_LEN(var_name) != 0) {
+                                        ZVAL_STR_COPY(&final_name, var_name);
+                                }
+                                /* break omitted intentionally */
+
+                        case EXTR_PREFIX_ALL:
+                                if (Z_TYPE(final_name) == IS_NULL && ZSTR_LEN(var_name) != 0) {
+                                        php_prefix_varname(&final_name, prefix, ZSTR_VAL(var_name), ZSTR_LEN(var_name), 1);
+                                }
+                                break;
+
+                        case EXTR_PREFIX_INVALID:
+                                if (Z_TYPE(final_name) == IS_NULL) {
+                                        if (!php_valid_var_name(ZSTR_VAL(var_name), ZSTR_LEN(var_name))) {
+                                                php_prefix_varname(&final_name, prefix, ZSTR_VAL(var_name), ZSTR_LEN(var_name), 1);
+                                        } else {
+                                                ZVAL_STR_COPY(&final_name, var_name);
+                                        }
+                                }
+                                break;
+
+                        default:
+                                if (!var_exists) {
+                                        ZVAL_STR_COPY(&final_name, var_name);
+                                }
+                                break;
+                }
+
+                if (Z_TYPE(final_name) == IS_STRING && php_valid_var_name(Z_STRVAL(final_name), Z_STRLEN(final_name))) {
+                        zval *orig_var;
+                        if (extract_refs) {
+
+                                ZVAL_MAKE_REF(entry);
+                                Z_ADDREF_P(entry);
+
+                                if ((orig_var = zend_hash_find(symbol_table, Z_STR(final_name))) != NULL) {
+                                        if (Z_TYPE_P(orig_var) == IS_INDIRECT) {
+                                                orig_var = Z_INDIRECT_P(orig_var);
+                                        }
+                                        zval_ptr_dtor(orig_var);
+                                        ZVAL_COPY_VALUE(orig_var, entry);
+                                } else {
+                                        zend_hash_update(symbol_table, Z_STR(final_name), entry);
+                                }
+                        } else {
+                                ZVAL_DEREF(entry);
+                                if (Z_REFCOUNTED_P(entry)) Z_ADDREF_P(entry);
+                                if ((orig_var = zend_hash_find(symbol_table, Z_STR(final_name))) != NULL) {
+                                        if (Z_TYPE_P(orig_var) == IS_INDIRECT) {
+                                                orig_var = Z_INDIRECT_P(orig_var);
+                                        }
+                                        ZVAL_DEREF(orig_var);
+                                        zval_ptr_dtor(orig_var);
+                                        ZVAL_COPY_VALUE(orig_var, entry);
+                                } else {
+                                        zend_hash_update(symbol_table, Z_STR(final_name), entry);
+                                }
+                        }
+                        count++;
+                }
+                zval_dtor(&final_name);
+        } ZEND_HASH_FOREACH_END();
+        zval_ptr_dtor(&var_array);
+
+        RETURN_LONG(count);
+}
+/* }}} */
+
+
+
+
+ZEND_BEGIN_ARG_INFO_EX(suhosin_arginfo_extract, 0, 0, 1)
+        ZEND_ARG_INFO(ZEND_SEND_PREFER_REF, arg) /* ARRAY_INFO(0, arg, 0) */
+        ZEND_ARG_INFO(0, extract_type)
+        ZEND_ARG_INFO(0, prefix)
+ZEND_END_ARG_INFO()
+
+
+/* {{{ suhosin_ex_imp_functions[]
+ */
+zend_function_entry suhosin_ex_imp_functions[] = {
+        PHP_NAMED_FE(extract, PHP_FN(suhosin_extract), suhosin_arginfo_extract)
+        {NULL, NULL, NULL}
+};
+/* }}} */
+
+void suhosin_hook_ex_imp()
+{
+        /* replace the extract and import_request_variables functions */
+        zend_hash_str_del(CG(function_table), ZEND_STRL("extract"));
+        zend_register_functions(NULL, suhosin_ex_imp_functions, NULL, MODULE_PERSISTENT);
+}
+
+
+/*
+ * Local variables:
+ * tab-width: 4
+ * c-basic-offset: 4
+ * End:
+ * vim600: noet sw=4 ts=4 fdm=marker
+ * vim<600: noet sw=4 ts=4
+ */
diff --git a/ifilter.c b/ifilter.c
index 2d41048..a8fa8e2 100644
--- a/ifilter.c
+++ b/ifilter.c
@@ -41,7 +41,7 @@ static size_t strnlen(const char *s, size_t maxlen) {
 }
 #endif
 
-static size_t suhosin_strnspn(const char *input, size_t n, const char *accept)
+size_t suhosin_strnspn(const char *input, size_t n, const char *accept)
 {
         size_t count = 0;
         for (; *input != '\0' && count < n; input++, count++) {
@@ -51,7 +51,7 @@ static size_t suhosin_strnspn(const char *input, size_t n, const char *accept)
         return count;
 }
 
-static size_t suhosin_strncspn(const char *input, size_t n, const char *reject)
+size_t suhosin_strncspn(const char *input, size_t n, const char *reject)
 {
         size_t count = 0;
         for (; *input != '\0' && count < n; input++, count++) {
@@ -635,7 +635,7 @@ SAPI_INPUT_FILTER_FUNC(suhosin_input_filter_wrapper)
         // }
         
         // if (!already_scanned) {
-                if (suhosin_input_filter(arg, var, val, val_len, new_val_len)==0) {
+                if (suhosin_input_filter(arg, var, val, val_len, new_val_len) == 0) {
                         SUHOSIN7_G(abort_request)=1;
                         return 0;
                 }
@@ -644,7 +644,14 @@ SAPI_INPUT_FILTER_FUNC(suhosin_input_filter_wrapper)
                 }
         // }
         if (orig_input_filter) {
-                return orig_input_filter(arg, var, val, val_len, new_val_len);
+
+                if (orig_input_filter(arg, var, val, val_len, new_val_len) == 0) {
+                        SUHOSIN7_G(abort_request)=1;
+                        return 0;
+                } else {
+                        return 1;
+                }
+
         } else {
                 return 1;
         }
diff --git a/php_suhosin7.h b/php_suhosin7.h
index 75244fe..6c515ba 100644
--- a/php_suhosin7.h
+++ b/php_suhosin7.h
@@ -205,16 +205,16 @@ ZEND_BEGIN_MODULE_GLOBALS(suhosin7)
         zend_bool  disallow_post_ws;
         
 /*      fileupload */
-        // zend_long  upload_limit;
-        // zend_long  upload_max_newlines;
-        // zend_long  num_uploads;
-        // zend_bool  upload_disallow_elf;
-        // zend_bool  upload_disallow_binary;
-        // zend_bool  upload_remove_binary;
+        zend_long  upload_max_newlines;
+        zend_long  upload_limit;
+        zend_long  num_uploads;
+        zend_bool  upload_disallow_elf;
+        zend_bool  upload_disallow_binary;
+        zend_bool  upload_remove_binary;
 #ifdef SUHOSIN7_EXPERIMENTAL
-        // zend_bool  upload_allow_utf8;
+        zend_bool  upload_allow_utf8;
 #endif
-        // char *upload_verification_script;
+        char *upload_verification_script;
 
         zend_bool  no_more_variables;
         zend_bool  no_more_get_variables;
@@ -389,12 +389,18 @@ void suhosin_hook_header_handler();
 void suhosin_unhook_header_handler();
 void suhosin_hook_execute();
 // void suhosin_hook_sha256();
+void suhosin_hook_ex_imp();
+
 #ifdef HAVE_PHP_SESSION
 void suhosin_hook_session();
 #endif
 
+void suhosin_hook_post_handlers();
+
 // ifilter.c
 void suhosin_normalize_varname(char *varname);
+size_t suhosin_strnspn(const char *input, size_t n, const char *accept);
+size_t suhosin_strncspn(const char *input, size_t n, const char *reject);
 
 // cookiecrypt.c
 char *suhosin_cookie_decryptor(char *raw_cookie);
@@ -413,6 +419,7 @@ void suhosin_aes_gkey(int nb,int nk,char *key);
 void suhosin_aes_encrypt(char *buff);
 void suhosin_aes_decrypt(char *buff);
 
+
 //
 
 static inline void suhosin_bailout()
@@ -431,7 +438,7 @@ static inline char *suhosin_get_active_function_name() {
 }
 
 #ifdef SUHOSIN_STRCASESTR
-char *suhosin_strcasestr(char *haystack, char *needle)
+char *suhosin_strcasestr(char *haystack, char *needle);
 #else
 #define suhosin_strcasestr(a, b) strcasestr(a, b)
 #endif
diff --git a/post_handler.c b/post_handler.c
new file mode 100644
index 0000000..1a2374c
--- /dev/null
+++ b/post_handler.c
@@ -0,0 +1,145 @@
+/*
+  +----------------------------------------------------------------------+
+  | Suhosin Version 1                                                    |
+  +----------------------------------------------------------------------+
+  | Copyright (c) 2006-2007 The Hardened-PHP Project                     |
+  | Copyright (c) 2007-2016 SektionEins GmbH                             |
+  +----------------------------------------------------------------------+
+  | This source file is subject to version 3.01 of the PHP license,      |
+  | that is bundled with this package in the file LICENSE, and is        |
+  | available through the world-wide-web at the following url:           |
+  | http://www.php.net/license/3_01.txt                                  |
+  | If you did not receive a copy of the PHP license and are unable to   |
+  | obtain it through the world-wide-web, please send a note to          |
+  | license@php.net so we can mail you a copy immediately.               |
+  +----------------------------------------------------------------------+
+  | Authors: Stefan Esser <sesser@sektioneins.de>                        |
+  |          Ben Fuhrmannek <ben.fuhrmannek@sektioneins.de>              |
+  +----------------------------------------------------------------------+
+*/
+/*
+  $Id: post_handler.c,v 1.1.1.1 2007-11-28 01:15:35 sesser Exp $ 
+*/
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "php.h"
+#include "php_ini.h"
+#include "php_suhosin7.h"
+#include "SAPI.h"
+#include "php_variables.h"
+#include "php_content_types.h"
+#include "suhosin_rfc1867.h"
+#include "ext/standard/url.h"
+#include "ext/standard/php_smart_string.h"
+
+#if defined(PHP_WIN32)
+#include "win32/php_inttypes.h"
+#endif
+
+SAPI_POST_HANDLER_FUNC(suhosin_rfc1867_post_handler);
+
+static void suhosin_post_handler_modification(sapi_post_entry *spe)
+{
+        char *content_type = estrndup(spe->content_type, spe->content_type_len);
+        suhosin_log(S_VARS, "some extension replaces the POST handler for %s - Suhosin's protection might be incomplete", content_type);
+        efree(content_type);
+}
+
+// static PHP_INI_MH((*old_OnUpdate_mbstring_encoding_translation)) = NULL;
+// 
+// /* {{{ static PHP_INI_MH(suhosin_OnUpdate_mbstring_encoding_translation) */
+// static PHP_INI_MH(suhosin_OnUpdate_mbstring_encoding_translation)
+// {
+//      zend_bool *p;
+// #ifndef ZTS
+//      char *base = (char *) mh_arg2;
+// #else
+//      char *base;
+// 
+//      base = (char *) ts_resource(*((int *) mh_arg2));
+// #endif
+// 
+//      p = (zend_bool *) (base+(size_t) mh_arg1);
+// 
+//      if (new_value_length == 2 && strcasecmp("on", new_value) == 0) {
+//                      *p = (zend_bool) 1;
+//      }
+//      else if (new_value_length == 3 && strcasecmp("yes", new_value) == 0) {
+//              *p = (zend_bool) 1;
+//      }
+//      else if (new_value_length == 4 && strcasecmp("true", new_value) == 0) {
+//              *p = (zend_bool) 1;
+//      }
+//      else {
+//              *p = (zend_bool) atoi(new_value);
+//      }
+//      if (*p) {
+//              suhosin_log(S_VARS, "Dynamic configuration (maybe a .htaccess file) tried to activate mbstring.encoding_translation which is incompatible with suhosin");
+//      }
+//      return SUCCESS;
+// }
+/* }}} */
+
+/* {{{ php_post_entries[]
+ */
+static sapi_post_entry suhosin_post_entries[] = {
+        // { DEFAULT_POST_CONTENT_TYPE, sizeof(DEFAULT_POST_CONTENT_TYPE)-1, sapi_read_standard_form_data,      suhosin_std_post_handler },
+        { ZEND_STRL(MULTIPART_CONTENT_TYPE), NULL, suhosin_rfc1867_post_handler },
+        { NULL, 0, NULL, NULL }
+};
+/* }}} */
+
+void suhosin_hook_post_handlers()
+{
+        HashTable tempht;
+        // zend_ini_entry *ini_entry;
+        
+        sapi_unregister_post_entry(&suhosin_post_entries[0]);
+        // sapi_unregister_post_entry(&suhosin_post_entries[1]);
+        sapi_register_post_entries(suhosin_post_entries);
+
+        /* we want to get notified if another extension deregisters the suhosin post handlers */
+
+        /* we need to tell suhosin patch that there is a new valid destructor */
+        /* therefore we have create HashTable that has this destructor */
+        // zend_hash_init(&tempht, 0, NULL, (dtor_func_t)suhosin_post_handler_modification, 0);
+        // zend_hash_destroy(&tempht);
+        /* And now we can overwrite the destructor for post entries */
+        // SG(known_post_content_types).pDestructor = (dtor_func_t)suhosin_post_handler_modification;
+        
+        /* we have to stop mbstring from replacing our post handler */
+        // if (zend_hash_find(EG(ini_directives), "mbstring.encoding_translation", sizeof("mbstring.encoding_translation"), (void **) &ini_entry) == FAILURE) {
+        //      return;
+        // }
+        /* replace OnUpdate_mbstring_encoding_translation handler */
+        // old_OnUpdate_mbstring_encoding_translation = ini_entry->on_modify;
+        // ini_entry->on_modify = suhosin_OnUpdate_mbstring_encoding_translation;
+}
+
+// void suhosin_unhook_post_handlers()
+// {
+//      zend_ini_entry *ini_entry;
+// 
+//      /* Restore to an empty destructor */
+//      SG(known_post_content_types).pDestructor = NULL;
+// 
+//      /* Now restore the ini entry handler */
+//      if (zend_hash_find(EG(ini_directives), "mbstring.encoding_translation", sizeof("mbstring.encoding_translation"), (void **) &ini_entry) == FAILURE) {
+//              return;
+//      }
+//      /* replace OnUpdate_mbstring_encoding_translation handler */
+//      ini_entry->on_modify = old_OnUpdate_mbstring_encoding_translation;
+//      old_OnUpdate_mbstring_encoding_translation = NULL;
+// }
+
+/*
+ * Local variables:
+ * tab-width: 4
+ * c-basic-offset: 4
+ * End:
+ * vim600: noet sw=4 ts=4 fdm=marker
+ * vim<600: noet sw=4 ts=4
+ */
diff --git a/rfc1867.c b/rfc1867.c
new file mode 100644
index 0000000..8daa0e8
--- /dev/null
+++ b/rfc1867.c
@@ -0,0 +1,1370 @@
+/*
+  +----------------------------------------------------------------------+
+  | Suhosin Version 1                                                    |
+  +----------------------------------------------------------------------+
+  | Copyright (c) 2006-2007 The Hardened-PHP Project                     |
+  | Copyright (c) 2007-2016 SektionEins GmbH                             |
+  +----------------------------------------------------------------------+
+  | This source file is subject to version 3.01 of the PHP license,      |
+  | that is bundled with this package in the file LICENSE, and is        |
+  | available through the world-wide-web at the following url:           |
+  | http://www.php.net/license/3_01.txt                                  |
+  | If you did not receive a copy of the PHP license and are unable to   |
+  | obtain it through the world-wide-web, please send a note to          |
+  | license@php.net so we can mail you a copy immediately.               |
+  +----------------------------------------------------------------------+
+  | Authors: Stefan Esser <sesser@sektioneins.de>                        |
+  |          Ben Fuhrmannek <ben.fuhrmannek@sektioneins.de>              |
+  +----------------------------------------------------------------------+
+  
+  Note: The following code is based on main/rfc1867.c from PHP 7.
+  | Copyright (c) 1997-2016 The PHP Group                                |
+  Original PHP Version 7 Authors:
+  | Authors: Rasmus Lerdorf <rasmus@php.net>                             |
+  |          Jani Taskinen <jani@php.net>                                |
+
+ */
+
+/* $Id$ */
+
+/*
+ *  This product includes software developed by the Apache Group
+ *  for use in the Apache HTTP server project (http://www.apache.org/).
+ *
+ */
+
+#include <stdio.h>
+#include "php.h"
+#include "php_open_temporary_file.h"
+#include "zend_globals.h"
+#include "php_globals.h"
+#include "php_variables.h"
+// #include "rfc1867.h"
+#include "suhosin_rfc1867.h"
+#include "php_suhosin7.h"
+#include "ext/standard/php_string.h"
+#include "ext/standard/php_smart_string.h"
+
+#if defined(PHP_WIN32) && !defined(HAVE_ATOLL)
+# define atoll(s) _atoi64(s)
+# define HAVE_ATOLL 1
+#endif
+
+#define DEBUG_FILE_UPLOAD ZEND_DEBUG
+
+static int dummy_encoding_translation(void)
+{
+        return 0;
+}
+
+static char *php_ap_getword(const zend_encoding *encoding, char **line, char stop);
+static char *php_ap_getword_conf(const zend_encoding *encoding, char *str);
+
+static php_rfc1867_encoding_translation_t php_rfc1867_encoding_translation = dummy_encoding_translation;
+static php_rfc1867_get_detect_order_t php_rfc1867_get_detect_order = NULL;
+static php_rfc1867_set_input_encoding_t php_rfc1867_set_input_encoding = NULL;
+static php_rfc1867_getword_t php_rfc1867_getword = php_ap_getword;
+static php_rfc1867_getword_conf_t php_rfc1867_getword_conf = php_ap_getword_conf;
+static php_rfc1867_basename_t php_rfc1867_basename = NULL;
+
+#define php_rfc1867_callback suhosin_rfc1867_filter
+// PHPAPI int (*php_rfc1867_callback)(unsigned int event, void *event_data, void **extra) = NULL;
+
+static void safe_php_register_variable(char *var, char *strval, size_t val_len, zval *track_vars_array, zend_bool override_protection);
+
+/* The longest property name we use in an uploaded file array */
+#define MAX_SIZE_OF_INDEX sizeof("[tmp_name]")
+
+/* The longest anonymous name */
+#define MAX_SIZE_ANONNAME 33
+
+/* Errors */
+#define UPLOAD_ERROR_OK   0  /* File upload successful */
+#define UPLOAD_ERROR_A    1  /* Uploaded file exceeded upload_max_filesize */
+#define UPLOAD_ERROR_B    2  /* Uploaded file exceeded MAX_FILE_SIZE */
+#define UPLOAD_ERROR_C    3  /* Partially uploaded */
+#define UPLOAD_ERROR_D    4  /* No file uploaded */
+#define UPLOAD_ERROR_E    6  /* Missing /tmp or similar directory */
+#define UPLOAD_ERROR_F    7  /* Failed to write file to disk */
+#define UPLOAD_ERROR_X    8  /* File upload stopped by extension */
+
+// void php_rfc1867_register_constants(void) /* {{{ */
+// {
+//      REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_OK",         UPLOAD_ERROR_OK, CONST_CS | CONST_PERSISTENT);
+//      REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_INI_SIZE",   UPLOAD_ERROR_A,  CONST_CS | CONST_PERSISTENT);
+//      REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_FORM_SIZE",  UPLOAD_ERROR_B,  CONST_CS | CONST_PERSISTENT);
+//      REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_PARTIAL",    UPLOAD_ERROR_C,  CONST_CS | CONST_PERSISTENT);
+//      REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_NO_FILE",    UPLOAD_ERROR_D,  CONST_CS | CONST_PERSISTENT);
+//      REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_NO_TMP_DIR", UPLOAD_ERROR_E,  CONST_CS | CONST_PERSISTENT);
+//      REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_CANT_WRITE", UPLOAD_ERROR_F,  CONST_CS | CONST_PERSISTENT);
+//      REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_EXTENSION",  UPLOAD_ERROR_X,  CONST_CS | CONST_PERSISTENT);
+// }
+/* }}} */
+
+static void normalize_protected_variable(char *varname) /* {{{ */
+{
+        char *s = varname, *index = NULL, *indexend = NULL, *p;
+
+        /* overjump leading space */
+        while (*s == ' ') {
+                s++;
+        }
+
+        /* and remove it */
+        if (s != varname) {
+                memmove(varname, s, strlen(s)+1);
+        }
+
+        for (p = varname; *p && *p != '['; p++) {
+                switch(*p) {
+                        case ' ':
+                        case '.':
+                                *p = '_';
+                                break;
+                }
+        }
+
+        /* find index */
+        index = strchr(varname, '[');
+        if (index) {
+                index++;
+                s = index;
+        } else {
+                return;
+        }
+
+        /* done? */
+        while (index) {
+                while (*index == ' ' || *index == '\r' || *index == '\n' || *index=='\t') {
+                        index++;
+                }
+                indexend = strchr(index, ']');
+                indexend = indexend ? indexend + 1 : index + strlen(index);
+
+                if (s != index) {
+                        memmove(s, index, strlen(index)+1);
+                        s += indexend-index;
+                } else {
+                        s = indexend;
+                }
+
+                if (*s == '[') {
+                        s++;
+                        index = s;
+                } else {
+                        index = NULL;
+                }
+        }
+        *s = '\0';
+}
+/* }}} */
+
+static void add_protected_variable(char *varname) /* {{{ */
+{
+        normalize_protected_variable(varname);
+        zend_hash_str_add_empty_element(&PG(rfc1867_protected_variables), varname, strlen(varname));
+}
+/* }}} */
+
+static zend_bool is_protected_variable(char *varname) /* {{{ */
+{
+        normalize_protected_variable(varname);
+        return zend_hash_str_exists(&PG(rfc1867_protected_variables), varname, strlen(varname));
+}
+/* }}} */
+
+static void safe_php_register_variable(char *var, char *strval, size_t val_len, zval *track_vars_array, zend_bool override_protection) /* {{{ */
+{
+        if (override_protection || !is_protected_variable(var)) {
+                php_register_variable_safe(var, strval, val_len, track_vars_array);
+        }
+}
+/* }}} */
+
+static void safe_php_register_variable_ex(char *var, zval *val, zval *track_vars_array, zend_bool override_protection) /* {{{ */
+{
+        if (override_protection || !is_protected_variable(var)) {
+                php_register_variable_ex(var, val, track_vars_array);
+        }
+}
+/* }}} */
+
+static void register_http_post_files_variable(char *strvar, char *val, zval *http_post_files, zend_bool override_protection) /* {{{ */
+{
+        safe_php_register_variable(strvar, val, strlen(val), http_post_files, override_protection);
+}
+/* }}} */
+
+static void register_http_post_files_variable_ex(char *var, zval *val, zval *http_post_files, zend_bool override_protection) /* {{{ */
+{
+        safe_php_register_variable_ex(var, val, http_post_files, override_protection);
+}
+/* }}} */
+
+static int unlink_filename(zval *el) /* {{{ */
+{
+        zend_string *filename = Z_STR_P(el);
+        VCWD_UNLINK(ZSTR_VAL(filename));
+        return 0;
+}
+/* }}} */
+
+
+static void free_filename(zval *el) {
+        zend_string *filename = Z_STR_P(el);
+        zend_string_release(filename);
+}
+
+PHPAPI void destroy_uploaded_files_hash(void) /* {{{ */
+{
+        zend_hash_apply(SG(rfc1867_uploaded_files), unlink_filename);
+        zend_hash_destroy(SG(rfc1867_uploaded_files));
+        FREE_HASHTABLE(SG(rfc1867_uploaded_files));
+}
+/* }}} */
+
+/* {{{ Following code is based on apache_multipart_buffer.c from libapreq-0.33 package. */
+
+#define FILLUNIT (1024 * 5)
+
+typedef struct {
+
+        /* read buffer */
+        char *buffer;
+        char *buf_begin;
+        int  bufsize;
+        int  bytes_in_buffer;
+
+        /* boundary info */
+        char *boundary;
+        char *boundary_next;
+        int  boundary_next_len;
+
+        const zend_encoding *input_encoding;
+        const zend_encoding **detect_order;
+        size_t detect_order_size;
+} multipart_buffer;
+
+typedef struct {
+        char *key;
+        char *value;
+} mime_header_entry;
+
+/*
+ * Fill up the buffer with client data.
+ * Returns number of bytes added to buffer.
+ */
+static int fill_buffer(multipart_buffer *self)
+{
+        int bytes_to_read, total_read = 0, actual_read = 0;
+
+        /* shift the existing data if necessary */
+        if (self->bytes_in_buffer > 0 && self->buf_begin != self->buffer) {
+                memmove(self->buffer, self->buf_begin, self->bytes_in_buffer);
+        }
+
+        self->buf_begin = self->buffer;
+
+        /* calculate the free space in the buffer */
+        bytes_to_read = self->bufsize - self->bytes_in_buffer;
+
+        /* read the required number of bytes */
+        while (bytes_to_read > 0) {
+
+                char *buf = self->buffer + self->bytes_in_buffer;
+
+                actual_read = (int)sapi_module.read_post(buf, bytes_to_read);
+
+                /* update the buffer length */
+                if (actual_read > 0) {
+                        self->bytes_in_buffer += actual_read;
+                        SG(read_post_bytes) += actual_read;
+                        total_read += actual_read;
+                        bytes_to_read -= actual_read;
+                } else {
+                        break;
+                }
+        }
+
+        return total_read;
+}
+
+/* eof if we are out of bytes, or if we hit the final boundary */
+static int multipart_buffer_eof(multipart_buffer *self)
+{
+        if ( (self->bytes_in_buffer == 0 && fill_buffer(self) < 1) ) {
+                return 1;
+        } else {
+                return 0;
+        }
+}
+
+/* create new multipart_buffer structure */
+static multipart_buffer *multipart_buffer_new(char *boundary, int boundary_len)
+{
+        multipart_buffer *self = (multipart_buffer *) ecalloc(1, sizeof(multipart_buffer));
+
+        int minsize = boundary_len + 6;
+        if (minsize < FILLUNIT) minsize = FILLUNIT;
+
+        self->buffer = (char *) ecalloc(1, minsize + 1);
+        self->bufsize = minsize;
+
+        spprintf(&self->boundary, 0, "--%s", boundary);
+
+        self->boundary_next_len = (int)spprintf(&self->boundary_next, 0, "\n--%s", boundary);
+
+        self->buf_begin = self->buffer;
+        self->bytes_in_buffer = 0;
+
+        if (php_rfc1867_encoding_translation()) {
+                php_rfc1867_get_detect_order(&self->detect_order, &self->detect_order_size);
+        } else {
+                self->detect_order = NULL;
+                self->detect_order_size = 0;
+        }
+
+        self->input_encoding = NULL;
+
+        return self;
+}
+
+/*
+ * Gets the next CRLF terminated line from the input buffer.
+ * If it doesn't find a CRLF, and the buffer isn't completely full, returns
+ * NULL; otherwise, returns the beginning of the null-terminated line,
+ * minus the CRLF.
+ *
+ * Note that we really just look for LF terminated lines. This works
+ * around a bug in internet explorer for the macintosh which sends mime
+ * boundaries that are only LF terminated when you use an image submit
+ * button in a multipart/form-data form.
+ */
+static char *next_line(multipart_buffer *self)
+{
+        /* look for LF in the data */
+        char* line = self->buf_begin;
+        char* ptr = memchr(self->buf_begin, '\n', self->bytes_in_buffer);
+
+        if (ptr) {      /* LF found */
+
+                /* terminate the string, remove CRLF */
+                if ((ptr - line) > 0 && *(ptr-1) == '\r') {
+                        *(ptr-1) = 0;
+                } else {
+                        *ptr = 0;
+                }
+
+                /* bump the pointer */
+                self->buf_begin = ptr + 1;
+                self->bytes_in_buffer -= (self->buf_begin - line);
+
+        } else {        /* no LF found */
+
+                /* buffer isn't completely full, fail */
+                if (self->bytes_in_buffer < self->bufsize) {
+                        return NULL;
+                }
+                /* return entire buffer as a partial line */
+                line[self->bufsize] = 0;
+                self->buf_begin = ptr;
+                self->bytes_in_buffer = 0;
+        }
+
+        return line;
+}
+
+/* Returns the next CRLF terminated line from the client */
+static char *get_line(multipart_buffer *self)
+{
+        char* ptr = next_line(self);
+
+        if (!ptr) {
+                fill_buffer(self);
+                ptr = next_line(self);
+        }
+
+        return ptr;
+}
+
+/* Free header entry */
+static void php_free_hdr_entry(mime_header_entry *h)
+{
+        if (h->key) {
+                efree(h->key);
+        }
+        if (h->value) {
+                efree(h->value);
+        }
+}
+
+/* finds a boundary */
+static int find_boundary(multipart_buffer *self, char *boundary)
+{
+        char *line;
+
+        /* loop thru lines */
+        while( (line = get_line(self)) )
+        {
+                /* finished if we found the boundary */
+                if (!strcmp(line, boundary)) {
+                        return 1;
+                }
+        }
+
+        /* didn't find the boundary */
+        return 0;
+}
+
+/* parse headers */
+static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header)
+{
+        char *line;
+        mime_header_entry entry = {0};
+        smart_string buf_value = {0};
+        char *key = NULL;
+        size_t newlines = 0;
+        
+        /* didn't find boundary, abort */
+        if (!find_boundary(self, self->boundary)) {
+                return 0;
+        }
+
+        /* get lines of text, or CRLF_CRLF */
+
+        while ((line = get_line(self)) && line[0] != '\0') {
+                /* add header to table */
+                char *value = NULL;
+
+                if (php_rfc1867_encoding_translation()) {
+                        self->input_encoding = zend_multibyte_encoding_detector((const unsigned char *) line, strlen(line), self->detect_order, self->detect_order_size);
+                }
+
+                /* space in the beginning means same header */
+                if (!isspace(line[0])) {
+                        value = strchr(line, ':');
+                }
+
+                if (value) {
+                        if (buf_value.c && key) {
+                                /* new entry, add the old one to the list */
+                                smart_string_0(&buf_value);
+                                entry.key = key;
+                                entry.value = buf_value.c;
+                                zend_llist_add_element(header, &entry);
+                                buf_value.c = NULL;
+                                key = NULL;
+                        }
+
+                        *value = '\0';
+                        do { value++; } while (isspace(*value));
+
+                        key = estrdup(line);
+                        smart_string_appends(&buf_value, value);
+                        newlines = 0;
+                } else if (buf_value.c) { /* If no ':' on the line, add to previous line */
+                        newlines++;
+                        if (newlines > SUHOSIN7_G(upload_max_newlines)) {
+                                SUHOSIN7_G(abort_request) = 1;
+                                suhosin_log(S_FILES, "configured maximum number of newlines in RFC1867 MIME headers limit exceeded - dropping rest of upload");
+                                return 0;
+                        }
+                        smart_string_appends(&buf_value, line);
+
+                } else {
+                        continue;
+                }
+        }
+
+        if (buf_value.c && key) {
+                /* add the last one to the list */
+                smart_string_0(&buf_value);
+                entry.key = key;
+                entry.value = buf_value.c;
+                zend_llist_add_element(header, &entry);
+        }
+
+        return 1;
+}
+
+static char *php_mime_get_hdr_value(zend_llist header, char *key)
+{
+        mime_header_entry *entry;
+
+        if (key == NULL) {
+                return NULL;
+        }
+
+        entry = zend_llist_get_first(&header);
+        while (entry) {
+                if (!strcasecmp(entry->key, key)) {
+                        return entry->value;
+                }
+                entry = zend_llist_get_next(&header);
+        }
+
+        return NULL;
+}
+
+static char *php_ap_getword(const zend_encoding *encoding, char **line, char stop)
+{
+        char *pos = *line, quote;
+        char *res;
+
+        while (*pos && *pos != stop) {
+                if ((quote = *pos) == '"' || quote == '\'') {
+                        ++pos;
+                        while (*pos && *pos != quote) {
+                                if (*pos == '\\' && pos[1] && pos[1] == quote) {
+                                        pos += 2;
+                                } else {
+                                        ++pos;
+                                }
+                        }
+                        if (*pos) {
+                                ++pos;
+                        }
+                } else ++pos;
+        }
+        if (*pos == '\0') {
+                res = estrdup(*line);
+                *line += strlen(*line);
+                return res;
+        }
+
+        res = estrndup(*line, pos - *line);
+
+        while (*pos == stop) {
+                ++pos;
+        }
+
+        *line = pos;
+        return res;
+}
+
+static char *substring_conf(char *start, int len, char quote)
+{
+        char *result = emalloc(len + 1);
+        char *resp = result;
+        int i;
+
+        for (i = 0; i < len && start[i] != quote; ++i) {
+                if (start[i] == '\\' && (start[i + 1] == '\\' || (quote && start[i + 1] == quote))) {
+                        *resp++ = start[++i];
+                } else {
+                        *resp++ = start[i];
+                }
+        }
+
+        *resp = '\0';
+        return result;
+}
+
+static char *php_ap_getword_conf(const zend_encoding *encoding, char *str)
+{
+        while (*str && isspace(*str)) {
+                ++str;
+        }
+
+        if (!*str) {
+                return estrdup("");
+        }
+
+        if (*str == '"' || *str == '\'') {
+                char quote = *str;
+
+                str++;
+                return substring_conf(str, (int)strlen(str), quote);
+        } else {
+                char *strend = str;
+
+                while (*strend && !isspace(*strend)) {
+                        ++strend;
+                }
+                return substring_conf(str, strend - str, 0);
+        }
+}
+
+static char *php_ap_basename(const zend_encoding *encoding, char *path)
+{
+        char *s = strrchr(path, '\\');
+        char *s2 = strrchr(path, '/');
+
+        if (s && s2) {
+                if (s > s2) {
+                        ++s;
+                } else {
+                        s = ++s2;
+                }
+                return s;
+        } else if (s) {
+                return ++s;
+        } else if (s2) {
+                return ++s2;
+        }
+        return path;
+}
+
+/*
+ * Search for a string in a fixed-length byte string.
+ * If partial is true, partial matches are allowed at the end of the buffer.
+ * Returns NULL if not found, or a pointer to the start of the first match.
+ */
+static void *php_ap_memstr(char *haystack, int haystacklen, char *needle, int needlen, int partial)
+{
+        int len = haystacklen;
+        char *ptr = haystack;
+
+        /* iterate through first character matches */
+        while( (ptr = memchr(ptr, needle[0], len)) ) {
+
+                /* calculate length after match */
+                len = haystacklen - (ptr - (char *)haystack);
+
+                /* done if matches up to capacity of buffer */
+                if (memcmp(needle, ptr, needlen < len ? needlen : len) == 0 && (partial || len >= needlen)) {
+                        break;
+                }
+
+                /* next character */
+                ptr++; len--;
+        }
+
+        return ptr;
+}
+
+/* read until a boundary condition */
+static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes, int *end)
+{
+        size_t len, max;
+        char *bound;
+
+        /* fill buffer if needed */
+        if (bytes > self->bytes_in_buffer) {
+                fill_buffer(self);
+        }
+
+        /* look for a potential boundary match, only read data up to that point */
+        if ((bound = php_ap_memstr(self->buf_begin, self->bytes_in_buffer, self->boundary_next, self->boundary_next_len, 1))) {
+                max = bound - self->buf_begin;
+                if (end && php_ap_memstr(self->buf_begin, self->bytes_in_buffer, self->boundary_next, self->boundary_next_len, 0)) {
+                        *end = 1;
+                }
+        } else {
+                max = self->bytes_in_buffer;
+        }
+
+        /* maximum number of bytes we are reading */
+        len = max < bytes-1 ? max : bytes-1;
+
+        /* if we read any data... */
+        if (len > 0) {
+
+                /* copy the data */
+                memcpy(buf, self->buf_begin, len);
+                buf[len] = 0;
+
+                if (bound && len > 0 && buf[len-1] == '\r') {
+                        buf[--len] = 0;
+                }
+
+                /* update the buffer */
+                self->bytes_in_buffer -= (int)len;
+                self->buf_begin += len;
+        }
+
+        return (int)len;
+}
+
+/*
+  XXX: this is horrible memory-usage-wise, but we only expect
+  to do this on small pieces of form data.
+*/
+static char *multipart_buffer_read_body(multipart_buffer *self, size_t *len)
+{
+        char buf[FILLUNIT], *out=NULL;
+        int total_bytes=0, read_bytes=0;
+
+        while((read_bytes = multipart_buffer_read(self, buf, sizeof(buf), NULL))) {
+                out = erealloc(out, total_bytes + read_bytes + 1);
+                memcpy(out + total_bytes, buf, read_bytes);
+                total_bytes += read_bytes;
+        }
+
+        if (out) {
+                out[total_bytes] = '\0';
+        }
+        *len = total_bytes;
+
+        return out;
+}
+/* }}} */
+
+/*
+ * The combined READER/HANDLER
+ *
+ */
+
+SAPI_API SAPI_POST_HANDLER_FUNC(suhosin_rfc1867_post_handler) /* {{{ */
+{
+        char *boundary, *s = NULL, *boundary_end = NULL, *start_arr = NULL, *array_index = NULL;
+        char *lbuf = NULL, *abuf = NULL;
+        zend_string *temp_filename = NULL;
+        int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0, array_len = 0;
+        int64_t total_bytes = 0, max_file_size = 0;
+        int skip_upload = 0, anonindex = 0, is_anonymous;
+        HashTable *uploaded_files = NULL;
+        multipart_buffer *mbuff;
+        zval *array_ptr = (zval *) arg;
+        int fd = -1;
+        zend_llist header;
+        void *event_extra_data = NULL;
+        unsigned int llen = 0;
+        int upload_cnt = INI_INT("max_file_uploads");
+        const zend_encoding *internal_encoding = zend_multibyte_get_internal_encoding();
+        php_rfc1867_getword_t getword;
+        php_rfc1867_getword_conf_t getword_conf;
+        php_rfc1867_basename_t _basename;
+        zend_long count = 0;
+
+        if (php_rfc1867_encoding_translation() && internal_encoding) {
+                getword = php_rfc1867_getword;
+                getword_conf = php_rfc1867_getword_conf;
+                _basename = php_rfc1867_basename;
+        } else {
+                getword = php_ap_getword;
+                getword_conf = php_ap_getword_conf;
+                _basename = php_ap_basename;
+        }
+
+        if (SG(post_max_size) > 0 && SG(request_info).content_length > SG(post_max_size)) {
+                sapi_module.sapi_error(E_WARNING, "POST Content-Length of " ZEND_LONG_FMT " bytes exceeds the limit of " ZEND_LONG_FMT " bytes", SG(request_info).content_length, SG(post_max_size));
+                return;
+        }
+
+        /* Get the boundary */
+        boundary = strstr(content_type_dup, "boundary");
+        if (!boundary) {
+                int content_type_len = (int)strlen(content_type_dup);
+                char *content_type_lcase = estrndup(content_type_dup, content_type_len);
+
+                php_strtolower(content_type_lcase, content_type_len);
+                boundary = strstr(content_type_lcase, "boundary");
+                if (boundary) {
+                        boundary = content_type_dup + (boundary - content_type_lcase);
+                }
+                efree(content_type_lcase);
+        }
+
+        if (!boundary || !(boundary = strchr(boundary, '='))) {
+                sapi_module.sapi_error(E_WARNING, "Missing boundary in multipart/form-data POST data");
+                return;
+        }
+
+        boundary++;
+        boundary_len = (int)strlen(boundary);
+
+        if (boundary[0] == '"') {
+                boundary++;
+                boundary_end = strchr(boundary, '"');
+                if (!boundary_end) {
+                        sapi_module.sapi_error(E_WARNING, "Invalid boundary in multipart/form-data POST data");
+                        return;
+                }
+        } else {
+                /* search for the end of the boundary */
+                boundary_end = strpbrk(boundary, ",;");
+        }
+        if (boundary_end) {
+                boundary_end[0] = '\0';
+                boundary_len = boundary_end-boundary;
+        }
+
+        /* Initialize the buffer */
+        if (!(mbuff = multipart_buffer_new(boundary, boundary_len))) {
+                sapi_module.sapi_error(E_WARNING, "Unable to initialize the input buffer");
+                return;
+        }
+
+        /* Initialize $_FILES[] */
+        zend_hash_init(&PG(rfc1867_protected_variables), 8, NULL, NULL, 0);
+
+        ALLOC_HASHTABLE(uploaded_files);
+        zend_hash_init(uploaded_files, 8, NULL, free_filename, 0);
+        SG(rfc1867_uploaded_files) = uploaded_files;
+
+        if (Z_TYPE(PG(http_globals)[TRACK_VARS_FILES]) != IS_ARRAY) {
+                /* php_auto_globals_create_files() might have already done that */
+                array_init(&PG(http_globals)[TRACK_VARS_FILES]);
+        }
+
+        zend_llist_init(&header, sizeof(mime_header_entry), (llist_dtor_func_t) php_free_hdr_entry, 0);
+
+        if (php_rfc1867_callback != NULL) {
+                multipart_event_start event_start;
+
+                event_start.content_length = SG(request_info).content_length;
+                if (php_rfc1867_callback(MULTIPART_EVENT_START, &event_start, &event_extra_data) == FAILURE) {
+                        goto fileupload_done;
+                }
+        }
+
+        while (!multipart_buffer_eof(mbuff))
+        {
+                char buff[FILLUNIT];
+                char *cd = NULL, *param = NULL, *filename = NULL, *tmp = NULL;
+                size_t blen = 0, wlen = 0;
+                zend_off_t offset;
+
+                zend_llist_clean(&header);
+
+                if (!multipart_buffer_headers(mbuff, &header)) {
+                        goto fileupload_done;
+                }
+
+                if ((cd = php_mime_get_hdr_value(header, "Content-Disposition"))) {
+                        char *pair = NULL;
+                        int end = 0;
+
+                        while (isspace(*cd)) {
+                                ++cd;
+                        }
+
+                        while (*cd && (pair = getword(mbuff->input_encoding, &cd, ';')))
+                        {
+                                char *key = NULL, *word = pair;
+
+                                while (isspace(*cd)) {
+                                        ++cd;
+                                }
+
+                                if (strchr(pair, '=')) {
+                                        key = getword(mbuff->input_encoding, &pair, '=');
+
+                                        if (!strcasecmp(key, "name")) {
+                                                if (param) {
+                                                        efree(param);
+                                                }
+                                                param = getword_conf(mbuff->input_encoding, pair);
+                                                if (mbuff->input_encoding && internal_encoding) {
+                                                        unsigned char *new_param;
+                                                        size_t new_param_len;
+                                                        if ((size_t)-1 != zend_multibyte_encoding_converter(&new_param, &new_param_len, (unsigned char *)param, strlen(param), internal_encoding, mbuff->input_encoding)) {
+                                                                efree(param);
+                                                                param = (char *)new_param;
+                                                        }
+                                                }
+                                        } else if (!strcasecmp(key, "filename")) {
+                                                if (filename) {
+                                                        efree(filename);
+                                                }
+                                                filename = getword_conf(mbuff->input_encoding, pair);
+                                                if (mbuff->input_encoding && internal_encoding) {
+                                                        unsigned char *new_filename;
+                                                        size_t new_filename_len;
+                                                        if ((size_t)-1 != zend_multibyte_encoding_converter(&new_filename, &new_filename_len, (unsigned char *)filename, strlen(filename), internal_encoding, mbuff->input_encoding)) {
+                                                                efree(filename);
+                                                                filename = (char *)new_filename;
+                                                        }
+                                                }
+                                        }
+                                }
+                                if (key) {
+                                        efree(key);
+                                }
+                                efree(word);
+                        }
+
+                        /* Normal form variable, safe to read all data into memory */
+                        if (!filename && param) {
+                                size_t value_len;
+                                char *value = multipart_buffer_read_body(mbuff, &value_len);
+                                size_t new_val_len; /* Dummy variable */
+
+                                if (!value) {
+                                        value = estrdup("");
+                                        value_len = 0;
+                                }
+
+                                if (mbuff->input_encoding && internal_encoding) {
+                                        unsigned char *new_value;
+                                        size_t new_value_len;
+                                        if ((size_t)-1 != zend_multibyte_encoding_converter(&new_value, &new_value_len, (unsigned char *)value, value_len, internal_encoding, mbuff->input_encoding)) {
+                                                efree(value);
+                                                value = (char *)new_value;
+                                                value_len = new_value_len;
+                                        }
+                                }
+
+                                if (++count <= PG(max_input_vars) && sapi_module.input_filter(PARSE_POST, param, &value, value_len, &new_val_len)) {
+                                        if (php_rfc1867_callback != NULL) {
+                                                multipart_event_formdata event_formdata;
+                                                size_t newlength = new_val_len;
+
+                                                event_formdata.post_bytes_processed = SG(read_post_bytes);
+                                                event_formdata.name = param;
+                                                event_formdata.value = &value;
+                                                event_formdata.length = new_val_len;
+                                                event_formdata.newlength = &newlength;
+                                                if (php_rfc1867_callback(MULTIPART_EVENT_FORMDATA, &event_formdata, &event_extra_data) == FAILURE) {
+                                                        efree(param);
+                                                        efree(value);
+                                                        continue;
+                                                }
+                                                new_val_len = newlength;
+                                        }
+                                        safe_php_register_variable(param, value, new_val_len, array_ptr, 0);
+                                } else {
+                                        if (count == PG(max_input_vars) + 1) {
+                                                php_error_docref(NULL, E_WARNING, "Input variables exceeded " ZEND_LONG_FMT ". To increase the limit change max_input_vars in php.ini.", PG(max_input_vars));
+                                        }
+
+                                        if (php_rfc1867_callback != NULL) {
+                                                multipart_event_formdata event_formdata;
+
+                                                event_formdata.post_bytes_processed = SG(read_post_bytes);
+                                                event_formdata.name = param;
+                                                event_formdata.value = &value;
+                                                event_formdata.length = value_len;
+                                                event_formdata.newlength = NULL;
+                                                php_rfc1867_callback(MULTIPART_EVENT_FORMDATA, &event_formdata, &event_extra_data);
+                                        }
+                                }
+
+                                if (!strcasecmp(param, "MAX_FILE_SIZE")) {
+#ifdef HAVE_ATOLL
+                                        max_file_size = atoll(value);
+#else
+                                        max_file_size = strtoll(value, NULL, 10);
+#endif
+                                }
+
+                                efree(param);
+                                efree(value);
+                                continue;
+                        }
+
+                        /* If file_uploads=off, skip the file part */
+                        if (!PG(file_uploads)) {
+                                skip_upload = 1;
+                        } else if (upload_cnt <= 0) {
+                                skip_upload = 1;
+                                sapi_module.sapi_error(E_WARNING, "Maximum number of allowable file uploads has been exceeded");
+                        }
+
+                        /* Return with an error if the posted data is garbled */
+                        if (!param && !filename) {
+                                sapi_module.sapi_error(E_WARNING, "File Upload Mime headers garbled");
+                                goto fileupload_done;
+                        }
+
+                        if (!param) {
+                                is_anonymous = 1;
+                                param = emalloc(MAX_SIZE_ANONNAME);
+                                snprintf(param, MAX_SIZE_ANONNAME, "%u", anonindex++);
+                        } else {
+                                is_anonymous = 0;
+                        }
+
+                        /* New Rule: never repair potential malicious user input */
+                        if (!skip_upload) {
+                                long c = 0;
+                                tmp = param;
+
+                                while (*tmp) {
+                                        if (*tmp == '[') {
+                                                c++;
+                                        } else if (*tmp == ']') {
+                                                c--;
+                                                if (tmp[1] && tmp[1] != '[') {
+                                                        skip_upload = 1;
+                                                        break;
+                                                }
+                                        }
+                                        if (c < 0) {
+                                                skip_upload = 1;
+                                                break;
+                                        }
+                                        tmp++;
+                                }
+                                /* Brackets should always be closed */
+                                if(c != 0) {
+                                        skip_upload = 1;
+                                }
+                        }
+
+                        total_bytes = cancel_upload = 0;
+                        temp_filename = NULL;
+                        fd = -1;
+
+                        if (!skip_upload && php_rfc1867_callback != NULL) {
+                                multipart_event_file_start event_file_start;
+
+                                event_file_start.post_bytes_processed = SG(read_post_bytes);
+                                event_file_start.name = param;
+                                event_file_start.filename = &filename;
+                                if (php_rfc1867_callback(MULTIPART_EVENT_FILE_START, &event_file_start, &event_extra_data) == FAILURE) {
+                                        temp_filename = NULL;
+                                        efree(param);
+                                        efree(filename);
+                                        continue;
+                                }
+                        }
+
+                        if (skip_upload) {
+                                efree(param);
+                                efree(filename);
+                                continue;
+                        }
+
+                        if (filename[0] == '\0') {
+#if DEBUG_FILE_UPLOAD
+                                sapi_module.sapi_error(E_NOTICE, "No file uploaded");
+#endif
+                                cancel_upload = UPLOAD_ERROR_D;
+                        }
+
+                        offset = 0;
+                        end = 0;
+
+                        if (!cancel_upload) {
+                                /* only bother to open temp file if we have data */
+                                blen = multipart_buffer_read(mbuff, buff, sizeof(buff), &end);
+#if DEBUG_FILE_UPLOAD
+                                if (blen > 0) {
+#else
+                                /* in non-debug mode we have no problem with 0-length files */
+                                {
+#endif
+                                        fd = php_open_temporary_fd_ex(PG(upload_tmp_dir), "php", &temp_filename, 1);
+                                        upload_cnt--;
+                                        if (fd == -1) {
+                                                sapi_module.sapi_error(E_WARNING, "File upload error - unable to create a temporary file");
+                                                cancel_upload = UPLOAD_ERROR_E;
+                                        }
+                                }
+                        }
+
+                        while (!cancel_upload && (blen > 0))
+                        {
+                                if (php_rfc1867_callback != NULL) {
+                                        multipart_event_file_data event_file_data;
+
+                                        event_file_data.post_bytes_processed = SG(read_post_bytes);
+                                        event_file_data.offset = offset;
+                                        event_file_data.data = buff;
+                                        event_file_data.length = blen;
+                                        event_file_data.newlength = &blen;
+                                        if (php_rfc1867_callback(MULTIPART_EVENT_FILE_DATA, &event_file_data, &event_extra_data) == FAILURE) {
+                                                cancel_upload = UPLOAD_ERROR_X;
+                                                continue;
+                                        }
+                                }
+
+                                if (PG(upload_max_filesize) > 0 && (zend_long)(total_bytes+blen) > PG(upload_max_filesize)) {
+#if DEBUG_FILE_UPLOAD
+                                        sapi_module.sapi_error(E_NOTICE, "upload_max_filesize of " ZEND_LONG_FMT " bytes exceeded - file [%s=%s] not saved", PG(upload_max_filesize), param, filename);
+#endif
+                                        cancel_upload = UPLOAD_ERROR_A;
+                                } else if (max_file_size && ((zend_long)(total_bytes+blen) > max_file_size)) {
+#if DEBUG_FILE_UPLOAD
+                                        sapi_module.sapi_error(E_NOTICE, "MAX_FILE_SIZE of " ZEND_LONG_FMT " bytes exceeded - file [%s=%s] not saved", max_file_size, param, filename);
+#endif
+                                        cancel_upload = UPLOAD_ERROR_B;
+                                } else if (blen > 0) {
+#ifdef PHP_WIN32
+                                        wlen = write(fd, buff, (unsigned int)blen);
+#else
+                                        wlen = write(fd, buff, blen);
+#endif
+
+                                        if (wlen == -1) {
+                                                /* write failed */
+#if DEBUG_FILE_UPLOAD
+                                                sapi_module.sapi_error(E_NOTICE, "write() failed - %s", strerror(errno));
+#endif
+                                                cancel_upload = UPLOAD_ERROR_F;
+                                        } else if (wlen < blen) {
+#if DEBUG_FILE_UPLOAD
+                                                sapi_module.sapi_error(E_NOTICE, "Only %d bytes were written, expected to write %d", wlen, blen);
+#endif
+                                                cancel_upload = UPLOAD_ERROR_F;
+                                        } else {
+                                                total_bytes += wlen;
+                                        }
+                                        offset += wlen;
+                                }
+
+                                /* read data for next iteration */
+                                blen = multipart_buffer_read(mbuff, buff, sizeof(buff), &end);
+                        }
+
+                        if (fd != -1) { /* may not be initialized if file could not be created */
+                                close(fd);
+                        }
+
+                        if (!cancel_upload && !end) {
+#if DEBUG_FILE_UPLOAD
+                                sapi_module.sapi_error(E_NOTICE, "Missing mime boundary at the end of the data for file %s", filename[0] != '\0' ? filename : "");
+#endif
+                                cancel_upload = UPLOAD_ERROR_C;
+                        }
+#if DEBUG_FILE_UPLOAD
+                        if (filename[0] != '\0' && total_bytes == 0 && !cancel_upload) {
+                                sapi_module.sapi_error(E_WARNING, "Uploaded file size 0 - file [%s=%s] not saved", param, filename);
+                                cancel_upload = 5;
+                        }
+#endif
+                        if (php_rfc1867_callback != NULL) {
+                                multipart_event_file_end event_file_end;
+
+                                event_file_end.post_bytes_processed = SG(read_post_bytes);
+                                event_file_end.temp_filename = ZSTR_VAL(temp_filename);
+                                event_file_end.cancel_upload = cancel_upload;
+                                if (php_rfc1867_callback(MULTIPART_EVENT_FILE_END, &event_file_end, &event_extra_data) == FAILURE) {
+                                        cancel_upload = UPLOAD_ERROR_X;
+                                }
+                        }
+
+                        if (cancel_upload) {
+                                if (temp_filename) {
+                                        if (cancel_upload != UPLOAD_ERROR_E) { /* file creation failed */
+                                                unlink(ZSTR_VAL(temp_filename));
+                                        }
+                                        zend_string_release(temp_filename);
+                                }
+                                temp_filename = NULL;
+                        } else {
+                                zend_hash_add_ptr(SG(rfc1867_uploaded_files), temp_filename, temp_filename);
+                        }
+
+                        /* is_arr_upload is true when name of file upload field
+                         * ends in [.*]
+                         * start_arr is set to point to 1st [ */
+                        is_arr_upload = (start_arr = strchr(param,'[')) && (param[strlen(param)-1] == ']');
+
+                        if (is_arr_upload) {
+                                array_len = (int)strlen(start_arr);
+                                if (array_index) {
+                                        efree(array_index);
+                                }
+                                array_index = estrndup(start_arr + 1, array_len - 2);
+                        }
+
+                        /* Add $foo_name */
+                        if (llen < strlen(param) + MAX_SIZE_OF_INDEX + 1) {
+                                llen = (int)strlen(param);
+                                lbuf = (char *) safe_erealloc(lbuf, llen, 1, MAX_SIZE_OF_INDEX + 1);
+                                llen += MAX_SIZE_OF_INDEX + 1;
+                        }
+
+                        if (is_arr_upload) {
+                                if (abuf) efree(abuf);
+                                abuf = estrndup(param, strlen(param)-array_len);
+                                snprintf(lbuf, llen, "%s_name[%s]", abuf, array_index);
+                        } else {
+                                snprintf(lbuf, llen, "%s_name", param);
+                        }
+
+                        /* The \ check should technically be needed for win32 systems only where
+                         * it is a valid path separator. However, IE in all it's wisdom always sends
+                         * the full path of the file on the user's filesystem, which means that unless
+                         * the user does basename() they get a bogus file name. Until IE's user base drops
+                         * to nill or problem is fixed this code must remain enabled for all systems. */
+                        s = _basename(internal_encoding, filename);
+                        if (!s) {
+                                s = filename;
+                        }
+
+                        if (!is_anonymous) {
+                                safe_php_register_variable(lbuf, s, strlen(s), NULL, 0);
+                        }
+
+                        /* Add $foo[name] */
+                        if (is_arr_upload) {
+                                snprintf(lbuf, llen, "%s[name][%s]", abuf, array_index);
+                        } else {
+                                snprintf(lbuf, llen, "%s[name]", param);
+                        }
+                        register_http_post_files_variable(lbuf, s, &PG(http_globals)[TRACK_VARS_FILES], 0);
+                        efree(filename);
+                        s = NULL;
+
+                        /* Possible Content-Type: */
+                        if (cancel_upload || !(cd = php_mime_get_hdr_value(header, "Content-Type"))) {
+                                cd = "";
+                        } else {
+                                /* fix for Opera 6.01 */
+                                s = strchr(cd, ';');
+                                if (s != NULL) {
+                                        *s = '\0';
+                                }
+                        }
+
+                        /* Add $foo_type */
+                        if (is_arr_upload) {
+                                snprintf(lbuf, llen, "%s_type[%s]", abuf, array_index);
+                        } else {
+                                snprintf(lbuf, llen, "%s_type", param);
+                        }
+                        if (!is_anonymous) {
+                                safe_php_register_variable(lbuf, cd, strlen(cd), NULL, 0);
+                        }
+
+                        /* Add $foo[type] */
+                        if (is_arr_upload) {
+                                snprintf(lbuf, llen, "%s[type][%s]", abuf, array_index);
+                        } else {
+                                snprintf(lbuf, llen, "%s[type]", param);
+                        }
+                        register_http_post_files_variable(lbuf, cd, &PG(http_globals)[TRACK_VARS_FILES], 0);
+
+                        /* Restore Content-Type Header */
+                        if (s != NULL) {
+                                *s = ';';
+                        }
+                        s = "";
+
+                        {
+                                /* store temp_filename as-is (in case upload_tmp_dir
+                                 * contains escapeable characters. escape only the variable name.) */
+                                zval zfilename;
+
+                                /* Initialize variables */
+                                add_protected_variable(param);
+
+                                /* if param is of form xxx[.*] this will cut it to xxx */
+                                if (!is_anonymous) {
+                                        if (temp_filename) {
+                                                ZVAL_STR_COPY(&zfilename, temp_filename);
+                                        } else {
+                                                ZVAL_EMPTY_STRING(&zfilename);
+                                        }
+                                        safe_php_register_variable_ex(param, &zfilename, NULL, 1);
+                                }
+
+                                /* Add $foo[tmp_name] */
+                                if (is_arr_upload) {
+                                        snprintf(lbuf, llen, "%s[tmp_name][%s]", abuf, array_index);
+                                } else {
+                                        snprintf(lbuf, llen, "%s[tmp_name]", param);
+                                }
+                                add_protected_variable(lbuf);
+                                if (temp_filename) {
+                                        ZVAL_STR_COPY(&zfilename, temp_filename);
+                                } else {
+                                        ZVAL_EMPTY_STRING(&zfilename);
+                                }
+                                register_http_post_files_variable_ex(lbuf, &zfilename, &PG(http_globals)[TRACK_VARS_FILES], 1);
+                        }
+
+                        {
+                                zval file_size, error_type;
+                                int size_overflow = 0;
+                                char file_size_buf[65];
+
+                                ZVAL_LONG(&error_type, cancel_upload);
+
+                                /* Add $foo[error] */
+                                if (cancel_upload) {
+                                        ZVAL_LONG(&file_size, 0);
+                                } else {
+                                        if (total_bytes > ZEND_LONG_MAX) {
+#ifdef PHP_WIN32
+                                                if (_i64toa_s(total_bytes, file_size_buf, 65, 10)) {
+                                                        file_size_buf[0] = '0';
+                                                        file_size_buf[1] = '\0';
+                                                }
+#else
+                                                {
+                                                        int __len = snprintf(file_size_buf, 65, "%lld", total_bytes);
+                                                        file_size_buf[__len] = '\0';
+                                                }
+#endif
+                                                size_overflow = 1;
+
+                                        } else {
+                                                ZVAL_LONG(&file_size, total_bytes);
+                                        }
+                                }
+
+                                if (is_arr_upload) {
+                                        snprintf(lbuf, llen, "%s[error][%s]", abuf, array_index);
+                                } else {
+                                        snprintf(lbuf, llen, "%s[error]", param);
+                                }
+                                register_http_post_files_variable_ex(lbuf, &error_type, &PG(http_globals)[TRACK_VARS_FILES], 0);
+
+                                /* Add $foo_size */
+                                if (is_arr_upload) {
+                                        snprintf(lbuf, llen, "%s_size[%s]", abuf, array_index);
+                                } else {
+                                        snprintf(lbuf, llen, "%s_size", param);
+                                }
+                                if (!is_anonymous) {
+                                        if (size_overflow) {
+                                                ZVAL_STRING(&file_size, file_size_buf);
+                                        }
+                                        safe_php_register_variable_ex(lbuf, &file_size, NULL, size_overflow);
+                                }
+
+                                /* Add $foo[size] */
+                                if (is_arr_upload) {
+                                        snprintf(lbuf, llen, "%s[size][%s]", abuf, array_index);
+                                } else {
+                                        snprintf(lbuf, llen, "%s[size]", param);
+                                }
+                                if (size_overflow) {
+                                        ZVAL_STRING(&file_size, file_size_buf);
+                                }
+                                register_http_post_files_variable_ex(lbuf, &file_size, &PG(http_globals)[TRACK_VARS_FILES], size_overflow);
+                        }
+                        efree(param);
+                }
+        }
+
+fileupload_done:
+        if (php_rfc1867_callback != NULL) {
+                multipart_event_end event_end;
+
+                event_end.post_bytes_processed = SG(read_post_bytes);
+                php_rfc1867_callback(MULTIPART_EVENT_END, &event_end, &event_extra_data);
+        }
+
+        if (lbuf) efree(lbuf);
+        if (abuf) efree(abuf);
+        if (array_index) efree(array_index);
+        zend_hash_destroy(&PG(rfc1867_protected_variables));
+        zend_llist_destroy(&header);
+        if (mbuff->boundary_next) efree(mbuff->boundary_next);
+        if (mbuff->boundary) efree(mbuff->boundary);
+        if (mbuff->buffer) efree(mbuff->buffer);
+        if (mbuff) efree(mbuff);
+}
+/* }}} */
+
+// SAPI_API void php_rfc1867_set_multibyte_callbacks(
+//                                      php_rfc1867_encoding_translation_t encoding_translation,
+//                                      php_rfc1867_get_detect_order_t get_detect_order,
+//                                      php_rfc1867_set_input_encoding_t set_input_encoding,
+//                                      php_rfc1867_getword_t getword,
+//                                      php_rfc1867_getword_conf_t getword_conf,
+//                                      php_rfc1867_basename_t basename) /* {{{ */
+// {
+//      php_rfc1867_encoding_translation = encoding_translation;
+//      php_rfc1867_get_detect_order = get_detect_order;
+//      php_rfc1867_set_input_encoding = set_input_encoding;
+//      php_rfc1867_getword = getword;
+//      php_rfc1867_getword_conf = getword_conf;
+//      php_rfc1867_basename = basename;
+// }
+/* }}} */
+
+/*
+ * Local variables:
+ * tab-width: 4
+ * c-basic-offset: 4
+ * End:
+ * vim600: sw=4 ts=4 fdm=marker
+ * vim<600: sw=4 ts=4
+ */
diff --git a/suhosin7.c b/suhosin7.c
index 6d6655a..2952629 100644
--- a/suhosin7.c
+++ b/suhosin7.c
@@ -356,15 +356,15 @@ PHP_INI_BEGIN()
         STD_S7_INI_ENTRY("suhosin.post.disallow_nul", "1", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdatePostBool, disallow_post_nul)
         STD_S7_INI_ENTRY("suhosin.post.disallow_ws", "0", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdatePostBool, disallow_post_ws)
         // 
-        // STD_S7_INI_ENTRY("suhosin.upload.max_uploads", "25", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateUploadLong, upload_limit)
-        // STD_S7_INI_ENTRY("suhosin.upload.max_newlines", "100", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateUploadLong, upload_max_newlines)
-        // STD_S7_INI_ENTRY("suhosin.upload.disallow_elf", "1", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateUploadBool, upload_disallow_elf)
-        // STD_S7_INI_ENTRY("suhosin.upload.disallow_binary", "0", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateUploadBool, upload_disallow_binary)
-        // STD_S7_INI_ENTRY("suhosin.upload.remove_binary", "0", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateUploadBool, upload_remove_binary)
+        STD_S7_INI_ENTRY("suhosin.upload.max_uploads", "25", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateUploadLong, upload_limit)
+        STD_S7_INI_ENTRY("suhosin.upload.max_newlines", "100", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateUploadLong, upload_max_newlines)
+        STD_S7_INI_ENTRY("suhosin.upload.disallow_elf", "1", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateUploadBool, upload_disallow_elf)
+        STD_S7_INI_ENTRY("suhosin.upload.disallow_binary", "0", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateUploadBool, upload_disallow_binary)
+        STD_S7_INI_ENTRY("suhosin.upload.remove_binary", "0", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateUploadBool, upload_remove_binary)
 #ifdef SUHOSIN7_EXPERIMENTAL
-        // STD_S7_INI_BOOLEAN("suhosin.upload.allow_utf8", "0", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateUploadBool, upload_allow_utf8)
+        STD_S7_INI_BOOLEAN("suhosin.upload.allow_utf8", "0", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateUploadBool, upload_allow_utf8)
 #endif
-        // STD_S7_INI_ENTRY("suhosin.upload.verification_script", NULL, PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateUploadString, upload_verification_script)
+        STD_S7_INI_ENTRY("suhosin.upload.verification_script", NULL, PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateUploadString, upload_verification_script)
 
 
         // STD_S7_INI_BOOLEAN("suhosin.sql.bailout_on_error",   "0",            PHP_INI_PERDIR|PHP_INI_SYSTEM,  OnUpdateSQLBool, sql_bailout_on_error)
@@ -520,10 +520,14 @@ PHP_MINIT_FUNCTION(suhosin7)
         suhosin_hook_execute();
         suhosin_hook_memory_limit();
         // suhosin_hook_sha256();
+        suhosin_hook_ex_imp();
+
 #ifdef HAVE_PHP_SESSION
         suhosin_hook_session();
 #endif
 
+        suhosin_hook_post_handlers();
+
         return SUCCESS;
 }
 /* }}} */
diff --git a/suhosin_rfc1867.h b/suhosin_rfc1867.h
new file mode 100644
index 0000000..5d946b0
--- /dev/null
+++ b/suhosin_rfc1867.h
@@ -0,0 +1,91 @@
+/*
+  +----------------------------------------------------------------------+
+  | Suhosin Version 1                                                    |
+  +----------------------------------------------------------------------+
+  | Copyright (c) 2006-2007 The Hardened-PHP Project                     |
+  | Copyright (c) 2007-2015 SektionEins GmbH                             |
+  +----------------------------------------------------------------------+
+  | This source file is subject to version 3.01 of the PHP license,      |
+  | that is bundled with this package in the file LICENSE, and is        |
+  | available through the world-wide-web at the following url:           |
+  | http://www.php.net/license/3_01.txt                                  |
+  | If you did not receive a copy of the PHP license and are unable to   |
+  | obtain it through the world-wide-web, please send a note to          |
+  | license@php.net so we can mail you a copy immediately.               |
+  +----------------------------------------------------------------------+
+  | Author: Stefan Esser <sesser@sektioneins.de>                         |
+  +----------------------------------------------------------------------+
+*/
+
+/* $Id: suhosin_rfc1867.h,v 1.1.1.1 2007-11-28 01:15:35 sesser Exp $ */
+
+#ifndef SUHOSIN_RFC1867_H
+#define SUHOSIN_RFC1867_H
+
+#include "rfc1867.h"
+#include "SAPI.h"
+
+// #define MULTIPART_CONTENT_TYPE "multipart/form-data"
+// #ifdef MULTIPART_EVENT_START
+// #define HAVE_RFC1867_CALLBACK                1
+// #else
+// #define HAVE_RFC1867_CALLBACK                0
+
+// #define MULTIPART_EVENT_START                0
+// #define MULTIPART_EVENT_FORMDATA     1
+// #define MULTIPART_EVENT_FILE_START   2
+// #define MULTIPART_EVENT_FILE_DATA    3
+// #define MULTIPART_EVENT_FILE_END     4
+// #define MULTIPART_EVENT_END          5
+// 
+// typedef struct _multipart_event_start {
+//      size_t  content_length;
+// } multipart_event_start;
+// 
+// typedef struct _multipart_event_formdata {
+//      size_t  post_bytes_processed;
+//      char    *name;
+//      char    **value;
+//      size_t  length;
+//      size_t  *newlength;
+// } multipart_event_formdata;
+// 
+// typedef struct _multipart_event_file_start {
+//      size_t  post_bytes_processed;
+//      char    *name;
+//      char    **filename;
+// } multipart_event_file_start;
+// 
+// typedef struct _multipart_event_file_data {
+//      size_t  post_bytes_processed;
+//      zend_off_t      offset;
+//      char    *data;
+//      size_t  length;
+//      size_t  *newlength;
+// } multipart_event_file_data;
+// 
+// typedef struct _multipart_event_file_end {
+//      size_t  post_bytes_processed;
+//      char    *temp_filename;
+//      int     cancel_upload;
+// } multipart_event_file_end;
+// 
+// typedef struct _multipart_event_end {
+//      size_t  post_bytes_processed;
+// } multipart_event_end;
+// 
+// 
+// #endif
+// 
+int suhosin_rfc1867_filter(unsigned int event, void *event_data, void **extra);
+
+SAPI_POST_HANDLER_FUNC(suhosin_rfc1867_post_handler);
+
+// void destroy_uploaded_files_hash(TSRMLS_D);
+// #if !HAVE_RFC1867_CALLBACK
+// extern PHP_SUHOSIN_API int (*php_rfc1867_callback)(unsigned int event, void *event_data, void **extra);
+// #else
+extern PHPAPI int (*php_rfc1867_callback)(unsigned int event, void *event_data, void **extra);
+// #endif
+
+#endif /* SUHOSIN_RFC1867_H */
diff --git a/tests/filter/cookie_disallow_nul.phpt b/tests/filter/cookie_disallow_nul.phpt
new file mode 100644
index 0000000..fc9975c
--- /dev/null
+++ b/tests/filter/cookie_disallow_nul.phpt
@@ -0,0 +1,32 @@
+--TEST--
+input filter: suhosin.cookie.disallow_nul
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.disallow_nul=0
+suhosin.cookie.disallow_nul=1
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+var1=xx%001;var2=2;var3=xx%003;var4=4;
+--GET--
+--POST--
+--FILE--
+<?php
+var_dump($_COOKIE);
+?>
+--EXPECTF--
+array(2) {
+  ["var2"]=>
+  string(1) "2"
+  ["var4"]=>
+  string(1) "4"
+}
+ALERT - ASCII-NUL chars not allowed within COOKIE variables - dropped variable 'var1' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - ASCII-NUL chars not allowed within COOKIE variables - dropped variable 'var3' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 2 request variables - (0 in GET, 0 in POST, 2 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/cookie_disallow_ws.phpt b/tests/filter/cookie_disallow_ws.phpt
new file mode 100644
index 0000000..fa1f1d4
--- /dev/null
+++ b/tests/filter/cookie_disallow_ws.phpt
@@ -0,0 +1,31 @@
+--TEST--
+input filter: suhosin.cookie.disallow_ws
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.cookie.disallow_ws=1
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
++var1=1;var2=2;%20var3=3; var4=4;
+--GET--
+--POST--
+--FILE--
+<?php
+var_dump($_COOKIE);
+?>
+--EXPECTF--
+array(2) {
+  ["var2"]=>
+  string(1) "2"
+  ["var4"]=>
+  string(1) "4"
+}
+ALERT - COOKIE variable name begins with disallowed whitespace - dropped variable ' var1' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - COOKIE variable name begins with disallowed whitespace - dropped variable ' var3' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 2 request variables - (0 in GET, 0 in POST, 2 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/cookie_max_array_depth.phpt b/tests/filter/cookie_max_array_depth.phpt
new file mode 100644
index 0000000..64614ef
--- /dev/null
+++ b/tests/filter/cookie_max_array_depth.phpt
@@ -0,0 +1,66 @@
+--TEST--
+input filter: suhosin.cookie.max_array_depth
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_array_depth=0
+suhosin.cookie.max_array_depth=4
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+var1[]=1;var2[][]=2;var3[][][]=3;var4[][][][]=4;var5[][][][][]=5;var6[][][][][][]=6;
+--GET--
+--POST--
+--FILE--
+<?php
+var_dump($_COOKIE);
+?>
+--EXPECTF--
+array(4) {
+  ["var1"]=>
+  array(1) {
+    [0]=>
+    string(1) "1"
+  }
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      string(1) "2"
+    }
+  }
+  ["var3"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      array(1) {
+        [0]=>
+        string(1) "3"
+      }
+    }
+  }
+  ["var4"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      array(1) {
+        [0]=>
+        array(1) {
+          [0]=>
+          string(1) "4"
+        }
+      }
+    }
+  }
+}
+ALERT - configured COOKIE variable array depth limit exceeded - dropped variable 'var5[][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured COOKIE variable array depth limit exceeded - dropped variable 'var6[][][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 2 request variables - (0 in GET, 0 in POST, 2 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/cookie_max_array_index_length.phpt b/tests/filter/cookie_max_array_index_length.phpt
new file mode 100644
index 0000000..19eddd1
--- /dev/null
+++ b/tests/filter/cookie_max_array_index_length.phpt
@@ -0,0 +1,53 @@
+--TEST--
+input filter: suhosin.cookie.max_array_index_length
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_array_index_length=0
+suhosin.cookie.max_array_index_length=3
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+var1[AAA]=1;var2[BBBB]=1;var3[AAA][BBB]=1;var4[AAA][BBBB]=4;var5[AAA][BBB][CCC]=1;var6[AAA][BBBB][CCC]=1;
+--GET--
+--POST--
+--FILE--
+<?php
+var_dump($_COOKIE);
+?>
+--EXPECTF--
+array(3) {
+  ["var1"]=>
+  array(1) {
+    ["AAA"]=>
+    string(1) "1"
+  }
+  ["var3"]=>
+  array(1) {
+    ["AAA"]=>
+    array(1) {
+      ["BBB"]=>
+      string(1) "1"
+    }
+  }
+  ["var5"]=>
+  array(1) {
+    ["AAA"]=>
+    array(1) {
+      ["BBB"]=>
+      array(1) {
+        ["CCC"]=>
+        string(1) "1"
+      }
+    }
+  }
+}
+ALERT - configured COOKIE variable array index length limit exceeded - dropped variable 'var2[BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured COOKIE variable array index length limit exceeded - dropped variable 'var4[AAA][BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured COOKIE variable array index length limit exceeded - dropped variable 'var6[AAA][BBBB][CCC]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 3 request variables - (0 in GET, 0 in POST, 3 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/cookie_max_name_length.phpt b/tests/filter/cookie_max_name_length.phpt
new file mode 100644
index 0000000..04f9537
--- /dev/null
+++ b/tests/filter/cookie_max_name_length.phpt
@@ -0,0 +1,43 @@
+--TEST--
+input filter: suhosin.cookie.max_name_length
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_varname_length=0
+suhosin.cookie.max_name_length=4
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+var=0;var1=1;var2[]=2;var3[xxx]=3;var04=4;var05[]=5;var06[xxx]=6;
+--GET--
+--POST--
+--FILE--
+<?php
+var_dump($_COOKIE);
+?>
+--EXPECTF--
+array(4) {
+  ["var"]=>
+  string(1) "0"
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    string(1) "2"
+  }
+  ["var3"]=>
+  array(1) {
+    ["xxx"]=>
+    string(1) "3"
+  }
+}
+ALERT - configured COOKIE variable name length limit exceeded - dropped variable 'var04' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured COOKIE variable name length limit exceeded - dropped variable 'var05[]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured COOKIE variable name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 3 request variables - (0 in GET, 0 in POST, 3 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/cookie_max_totalname_length.phpt b/tests/filter/cookie_max_totalname_length.phpt
new file mode 100644
index 0000000..6b9bb76
--- /dev/null
+++ b/tests/filter/cookie_max_totalname_length.phpt
@@ -0,0 +1,44 @@
+--TEST--
+input filter: suhosin.cookie.max_totalname_length
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_totalname_length=0
+suhosin.cookie.max_totalname_length=7
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+var=0;var1=1;var2[]=2;var3[xxx]=3;var04=4;var05[]=5;var06[xxx]=6;
+--GET--
+--POST--
+--FILE--
+<?php
+var_dump($_COOKIE);
+?>
+--EXPECTF--
+array(5) {
+  ["var"]=>
+  string(1) "0"
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    string(1) "2"
+  }
+  ["var04"]=>
+  string(1) "4"
+  ["var05"]=>
+  array(1) {
+    [0]=>
+    string(1) "5"
+  }
+}
+ALERT - configured COOKIE variable total name length limit exceeded - dropped variable 'var3[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured COOKIE variable total name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 2 request variables - (0 in GET, 0 in POST, 2 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/cookie_max_value_length.phpt b/tests/filter/cookie_max_value_length.phpt
new file mode 100644
index 0000000..f3d3ba8
--- /dev/null
+++ b/tests/filter/cookie_max_value_length.phpt
@@ -0,0 +1,35 @@
+--TEST--
+input filter: suhosin.cookie.max_value_length
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_value_length=0
+suhosin.cookie.max_value_length=3
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+var1=1;var2=22;var3=333;var4=4444;var5=55%00555;var6=666666;
+--GET--
+--POST--
+--FILE--
+<?php
+var_dump($_COOKIE);
+?>
+--EXPECTF--
+array(3) {
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  string(2) "22"
+  ["var3"]=>
+  string(3) "333"
+}
+ALERT - configured COOKIE variable value length limit exceeded - dropped variable 'var4' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured COOKIE variable value length limit exceeded - dropped variable 'var5' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured COOKIE variable value length limit exceeded - dropped variable 'var6' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 3 request variables - (0 in GET, 0 in POST, 3 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/cookie_max_vars.phpt b/tests/filter/cookie_max_vars.phpt
new file mode 100644
index 0000000..7389adb
--- /dev/null
+++ b/tests/filter/cookie_max_vars.phpt
@@ -0,0 +1,30 @@
+--TEST--
+input filter: suhosin.cookie.max_vars
+--SKIPIF--
+<?php include "../skipif.inc"; ?>
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.cookie.max_vars=3
+--COOKIE--
+a=1; b=2; c=3; d=4
+--FILE--
+<?php
+var_dump($_COOKIE);
+?>
+--EXPECTF--
+array(3) {
+  ["a"]=>
+  string(1) "1"
+  ["b"]=>
+  string(1) "2"
+  ["c"]=>
+  string(1) "3"
+}
+ALERT - configured COOKIE variable limit exceeded - dropped variable 'd' - all further COOKIE variables are dropped (attacker '%s', file '%s')
+ALERT - dropped 1 request variables - (0 in GET, 0 in POST, 1 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/filter_logging_statistics.phpt b/tests/filter/filter_logging_statistics.phpt
new file mode 100644
index 0000000..a4119b3
--- /dev/null
+++ b/tests/filter/filter_logging_statistics.phpt
@@ -0,0 +1,43 @@
+--TEST--
+suhosin variable filter logging statistics
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.get.max_vars=5
+error_reporting=E_ALL
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+A=A&B=B&C=C&D=D&E=E&F=F&G=G&
+--POST--
+--FILE--
+<?php
+$counter++;
+if ($counter < 5) {
+        include __FILE__;
+} else {
+        var_dump($_GET);        
+}
+?>
+--EXPECTF--
+Notice: Undefined variable: counter in %s on line 2
+array(5) {
+  ["A"]=>
+  string(1) "A"
+  ["B"]=>
+  string(1) "B"
+  ["C"]=>
+  string(1) "C"
+  ["D"]=>
+  string(1) "D"
+  ["E"]=>
+  string(1) "E"
+}
+ALERT - configured GET variable limit exceeded - dropped variable 'F' - all further GET variables are dropped (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 2 request variables - (2 in GET, 0 in POST, 0 in COOKIE) %s
diff --git a/tests/filter/get_allow_ws.phpt b/tests/filter/get_allow_ws.phpt
new file mode 100644
index 0000000..190e44c
--- /dev/null
+++ b/tests/filter/get_allow_ws.phpt
@@ -0,0 +1,56 @@
+--TEST--
+input filter: allow whitespace
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.stdout=255
+suhosin.log.script=0
+suhosin.request.disallow_ws=0
+suhosin.get.disallow_ws=0
+suhosin.post.disallow_ws=0
+suhosin.cookie.disallow_ws=0
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
++var1=1;var2=2;%20var3=3; var4=4;
+--GET--
++var1=1&var2=2&%20var3=3& var4=4&
+--POST--
++var1=1&var2=2&%20var3=3& var4=4&
+--FILE--
+<?php
+var_dump($_GET);
+var_dump($_POST);
+var_dump($_COOKIE);
+?>
+--EXPECTF--
+array(4) {
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  string(1) "2"
+  ["var3"]=>
+  string(1) "3"
+  ["var4"]=>
+  string(1) "4"
+}
+array(4) {
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  string(1) "2"
+  ["var3"]=>
+  string(1) "3"
+  ["var4"]=>
+  string(1) "4"
+}
+array(4) {
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  string(1) "2"
+  ["var3"]=>
+  string(1) "3"
+  ["var4"]=>
+  string(1) "4"
+}
\ No newline at end of file
diff --git a/tests/filter/get_disallow_nul.phpt b/tests/filter/get_disallow_nul.phpt
new file mode 100644
index 0000000..6432a4e
--- /dev/null
+++ b/tests/filter/get_disallow_nul.phpt
@@ -0,0 +1,32 @@
+--TEST--
+input filter: suhosin.get.disallow_nul
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.disallow_nul=0
+suhosin.get.disallow_nul=1
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+var1=xx%001&var2=2&var3=xx%003&var4=4&
+--POST--
+--FILE--
+<?php
+var_dump($_GET);
+?>
+--EXPECTF--
+array(2) {
+  ["var2"]=>
+  string(1) "2"
+  ["var4"]=>
+  string(1) "4"
+}
+ALERT - ASCII-NUL chars not allowed within GET variables - dropped variable 'var1' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - ASCII-NUL chars not allowed within GET variables - dropped variable 'var3' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 2 request variables - (2 in GET, 0 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/get_disallow_ws.phpt b/tests/filter/get_disallow_ws.phpt
new file mode 100644
index 0000000..c7b57de
--- /dev/null
+++ b/tests/filter/get_disallow_ws.phpt
@@ -0,0 +1,30 @@
+--TEST--
+input filter: suhosin.get.disallow_ws
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.get.disallow_ws=1
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
++var1=1&var2=2&%20var3=3& var4=4&
+--POST--
+--FILE--
+<?php
+var_dump($_GET);
+?>
+--EXPECTF--
+array(1) {
+  ["var2"]=>
+  string(1) "2"
+}
+ALERT - GET variable name begins with disallowed whitespace - dropped variable ' var1' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - GET variable name begins with disallowed whitespace - dropped variable ' var3' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - GET variable name begins with disallowed whitespace - dropped variable ' var4' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 3 request variables - (3 in GET, 0 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/get_filter_1.phpt b/tests/filter/get_filter_1.phpt
new file mode 100644
index 0000000..7bd9cc3
--- /dev/null
+++ b/tests/filter/get_filter_1.phpt
@@ -0,0 +1,45 @@
+--TEST--
+suhosin GET filter (disallowed variable names)
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+HTTP_RAW_POST_DATA=HTTP_RAW_POST_DATA&HTTP_SESSION_VARS=HTTP_SESSION_VARS&harmless1=harmless1&HTTP_SERVER_VARS=HTTP_SERVER_VARS&HTTP_COOKIE_VARS=HTTP_COOKIE_VARS&HTTP_POST_FILES=HTTP_POST_FILES&HTTP_POST_VARS=HTTP_POST_VARS&HTTP_GET_VARS=HTTP_GET_VARS&HTTP_ENV_VARS=HTTP_ENV_VARS&_SESSION=_SESSION&_REQUEST=_REQUEST&GLOBALS=GLOBALS&_COOKIE=_COOKIE&_SERVER=_SERVER&_FILES=_FILES&_POST=_POST&_ENV=_ENV&_GET=_GET&harmless2=harmless2&
+--POST--
+--FILE--
+<?php
+var_dump($_GET);
+?>
+--EXPECTF--
+array(2) {
+  ["harmless1"]=>
+  string(9) "harmless1"
+  ["harmless2"]=>
+  string(9) "harmless2"
+}
+ALERT - tried to register forbidden variable 'HTTP_RAW_POST_DATA' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_SESSION_VARS' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_SERVER_VARS' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_COOKIE_VARS' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_POST_FILES' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_POST_VARS' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_GET_VARS' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_ENV_VARS' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_SESSION' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_REQUEST' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'GLOBALS' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_COOKIE' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_SERVER' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_FILES' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_POST' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_ENV' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_GET' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 17 request variables - (17 in GET, 0 in POST, 0 in COOKIE) %s
diff --git a/tests/filter/get_filter_2.phpt b/tests/filter/get_filter_2.phpt
new file mode 100644
index 0000000..1e5d04c
--- /dev/null
+++ b/tests/filter/get_filter_2.phpt
@@ -0,0 +1,36 @@
+--TEST--
+suhosin GET filter (suhosin.get.max_vars)
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.get.max_vars=5
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+A=A&B=B&C=C&D=D&E=E&F=F&G=G&
+--POST--
+--FILE--
+<?php
+var_dump($_GET);
+?>
+--EXPECTF--
+array(5) {
+  ["A"]=>
+  string(1) "A"
+  ["B"]=>
+  string(1) "B"
+  ["C"]=>
+  string(1) "C"
+  ["D"]=>
+  string(1) "D"
+  ["E"]=>
+  string(1) "E"
+}
+ALERT - configured GET variable limit exceeded - dropped variable 'F' - all further GET variables are dropped (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 2 request variables - (2 in GET, 0 in POST, 0 in COOKIE) %s
diff --git a/tests/filter/get_globals.phpt b/tests/filter/get_globals.phpt
new file mode 100644
index 0000000..f16991b
--- /dev/null
+++ b/tests/filter/get_globals.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Testing: GLOBALS in GET
+--SKIPIF--
+<?php include "../skipifcli.inc"; ?>
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=255
+suhosin.log.script=255
+suhosin.log.script.name=/tmp/xx
+--GET--
+a=1&b=2&GLOBALS=123&c=3
+--FILE--
+<?php
+    var_dump($_GET['a']);
+    var_dump($_GET['b']);
+    var_dump($_GET['c']);
+    if (!isset($_GET['GLOBALS'])) var_dump(5);
+    else var_dump(0);
+?>
+--EXPECT--
+string(1) "1"
+string(1) "2"
+string(1) "3"
+int(5)
diff --git a/tests/filter/get_max_array_depth.phpt b/tests/filter/get_max_array_depth.phpt
new file mode 100644
index 0000000..2be4af1
--- /dev/null
+++ b/tests/filter/get_max_array_depth.phpt
@@ -0,0 +1,66 @@
+--TEST--
+input filter: suhosin.get.max_array_depth
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_array_depth=0
+suhosin.get.max_array_depth=4
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+var1[]=1&var2[][]=2&var3[][][]=3&var4[][][][]=4&var5[][][][][]=5&var6[][][][][][]=6&
+--POST--
+--FILE--
+<?php
+var_dump($_GET);
+?>
+--EXPECTF--
+array(4) {
+  ["var1"]=>
+  array(1) {
+    [0]=>
+    string(1) "1"
+  }
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      string(1) "2"
+    }
+  }
+  ["var3"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      array(1) {
+        [0]=>
+        string(1) "3"
+      }
+    }
+  }
+  ["var4"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      array(1) {
+        [0]=>
+        array(1) {
+          [0]=>
+          string(1) "4"
+        }
+      }
+    }
+  }
+}
+ALERT - configured GET variable array depth limit exceeded - dropped variable 'var5[][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured GET variable array depth limit exceeded - dropped variable 'var6[][][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 2 request variables - (2 in GET, 0 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/get_max_array_index_length.phpt b/tests/filter/get_max_array_index_length.phpt
new file mode 100644
index 0000000..65c8d18
--- /dev/null
+++ b/tests/filter/get_max_array_index_length.phpt
@@ -0,0 +1,53 @@
+--TEST--
+input filter: suhosin.get.max_array_index_length
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_array_index_length=0
+suhosin.get.max_array_index_length=3
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+var1[AAA]=1&var2[BBBB]=1&var3[AAA][BBB]=1&var4[AAA][BBBB]=4&var5[AAA][BBB][CCC]=1&var6[AAA][BBBB][CCC]=1
+--POST--
+--FILE--
+<?php
+var_dump($_GET);
+?>
+--EXPECTF--
+array(3) {
+  ["var1"]=>
+  array(1) {
+    ["AAA"]=>
+    string(1) "1"
+  }
+  ["var3"]=>
+  array(1) {
+    ["AAA"]=>
+    array(1) {
+      ["BBB"]=>
+      string(1) "1"
+    }
+  }
+  ["var5"]=>
+  array(1) {
+    ["AAA"]=>
+    array(1) {
+      ["BBB"]=>
+      array(1) {
+        ["CCC"]=>
+        string(1) "1"
+      }
+    }
+  }
+}
+ALERT - configured GET variable array index length limit exceeded - dropped variable 'var2[BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured GET variable array index length limit exceeded - dropped variable 'var4[AAA][BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured GET variable array index length limit exceeded - dropped variable 'var6[AAA][BBBB][CCC]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 3 request variables - (3 in GET, 0 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/get_max_name_length.phpt b/tests/filter/get_max_name_length.phpt
new file mode 100644
index 0000000..ef2f4a2
--- /dev/null
+++ b/tests/filter/get_max_name_length.phpt
@@ -0,0 +1,43 @@
+--TEST--
+input filter: suhosin.get.max_name_length
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_varname_length=0
+suhosin.get.max_name_length=4
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+var=0&var1=1&var2[]=2&var3[xxx]=3&var04=4&var05[]=5&var06[xxx]=6&
+--POST--
+--FILE--
+<?php
+var_dump($_GET);
+?>
+--EXPECTF--
+array(4) {
+  ["var"]=>
+  string(1) "0"
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    string(1) "2"
+  }
+  ["var3"]=>
+  array(1) {
+    ["xxx"]=>
+    string(1) "3"
+  }
+}
+ALERT - configured GET variable name length limit exceeded - dropped variable 'var04' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured GET variable name length limit exceeded - dropped variable 'var05[]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured GET variable name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 3 request variables - (3 in GET, 0 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/get_max_totalname_length.phpt b/tests/filter/get_max_totalname_length.phpt
new file mode 100644
index 0000000..83c7ffe
--- /dev/null
+++ b/tests/filter/get_max_totalname_length.phpt
@@ -0,0 +1,44 @@
+--TEST--
+input filter: suhosin.get.max_totalname_length
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_totalname_length=0
+suhosin.get.max_totalname_length=7
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+var=0&var1=1&var2[]=2&var3[xxx]=3&var04=4&var05[]=5&var06[xxx]=6&
+--POST--
+--FILE--
+<?php
+var_dump($_GET);
+?>
+--EXPECTF--
+array(5) {
+  ["var"]=>
+  string(1) "0"
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    string(1) "2"
+  }
+  ["var04"]=>
+  string(1) "4"
+  ["var05"]=>
+  array(1) {
+    [0]=>
+    string(1) "5"
+  }
+}
+ALERT - configured GET variable total name length limit exceeded - dropped variable 'var3[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured GET variable total name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 2 request variables - (2 in GET, 0 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/get_max_value_length.phpt b/tests/filter/get_max_value_length.phpt
new file mode 100644
index 0000000..a3c4435
--- /dev/null
+++ b/tests/filter/get_max_value_length.phpt
@@ -0,0 +1,35 @@
+--TEST--
+input filter: suhosin.get.max_value_length
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_value_length=0
+suhosin.get.max_value_length=3
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+var1=1&var2=22&var3=333&var4=4444&var5=55%00555&var6=666666&
+--POST--
+--FILE--
+<?php
+var_dump($_GET);
+?>
+--EXPECTF--
+array(3) {
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  string(2) "22"
+  ["var3"]=>
+  string(3) "333"
+}
+ALERT - configured GET variable value length limit exceeded - dropped variable 'var4' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured GET variable value length limit exceeded - dropped variable 'var5' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured GET variable value length limit exceeded - dropped variable 'var6' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 3 request variables - (3 in GET, 0 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/input_filter_allow_nul.phpt b/tests/filter/input_filter_allow_nul.phpt
new file mode 100644
index 0000000..e33ef67
--- /dev/null
+++ b/tests/filter/input_filter_allow_nul.phpt
diff --git a/tests/filter/input_filter_request_max_value_length.phpt b/tests/filter/input_filter_request_max_value_length.phpt
new file mode 100644
index 0000000..27b399e
--- /dev/null
+++ b/tests/filter/input_filter_request_max_value_length.phpt
@@ -0,0 +1,61 @@
+--TEST--
+input filter: suhosin.request.max_value_length
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_value_length=3
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+var1=1;var2=22;var3=333;var4=4444;var5=55%00555;var6=666666;
+--GET--
+var1=1&var2=22&var3=333&var4=4444&var5=55%00555&var6=666666&
+--POST--
+var1=1&var2=22&var3=333&var4=4444&var5=55%00555&var6=666666&
+--FILE--
+<?php
+var_dump($_GET);
+var_dump($_POST);
+var_dump($_COOKIE);
+?>
+--EXPECTF--
+array(3) {
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  string(2) "22"
+  ["var3"]=>
+  string(3) "333"
+}
+array(3) {
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  string(2) "22"
+  ["var3"]=>
+  string(3) "333"
+}
+array(3) {
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  string(2) "22"
+  ["var3"]=>
+  string(3) "333"
+}
+ALERT - configured request variable value length limit exceeded - dropped variable 'var4' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable value length limit exceeded - dropped variable 'var5' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable value length limit exceeded - dropped variable 'var6' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable value length limit exceeded - dropped variable 'var4' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable value length limit exceeded - dropped variable 'var5' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable value length limit exceeded - dropped variable 'var6' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable value length limit exceeded - dropped variable 'var4' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable value length limit exceeded - dropped variable 'var5' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable value length limit exceeded - dropped variable 'var6' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 9 request variables - (3 in GET, 3 in POST, 3 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
+
diff --git a/tests/filter/post_disallow_nul.phpt b/tests/filter/post_disallow_nul.phpt
new file mode 100644
index 0000000..395d096
--- /dev/null
+++ b/tests/filter/post_disallow_nul.phpt
@@ -0,0 +1,32 @@
+--TEST--
+input filter: suhosin.post.disallow_nul
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.disallow_nul=0
+suhosin.post.disallow_nul=1
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST--
+var1=xx%001&var2=2&var3=xx%003&var4=4&
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECTF--
+array(2) {
+  ["var2"]=>
+  string(1) "2"
+  ["var4"]=>
+  string(1) "4"
+}
+ALERT - ASCII-NUL chars not allowed within POST variables - dropped variable 'var1' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - ASCII-NUL chars not allowed within POST variables - dropped variable 'var3' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 2 request variables - (0 in GET, 2 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_disallow_nul_rfc1867.phpt b/tests/filter/post_disallow_nul_rfc1867.phpt
new file mode 100644
index 0000000..887873a
--- /dev/null
+++ b/tests/filter/post_disallow_nul_rfc1867.phpt
diff --git a/tests/filter/post_disallow_ws.phpt b/tests/filter/post_disallow_ws.phpt
new file mode 100644
index 0000000..f8abbfd
--- /dev/null
+++ b/tests/filter/post_disallow_ws.phpt
@@ -0,0 +1,31 @@
+--TEST--
+input filter: suhosin.post.disallow_ws
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.post.disallow_ws=1
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST--
++var1=1&var2=2&%20var3=3& var4=4&       var5=5&
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECTF--
+array(1) {
+  ["var2"]=>
+  string(1) "2"
+}
+ALERT - POST variable name begins with disallowed whitespace - dropped variable ' var1' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - POST variable name begins with disallowed whitespace - dropped variable ' var3' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - POST variable name begins with disallowed whitespace - dropped variable ' var4' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - POST variable name begins with disallowed whitespace - dropped variable '.var5' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 4 request variables - (0 in GET, 4 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_fileupload_array_index_blacklist.phpt b/tests/filter/post_fileupload_array_index_blacklist.phpt
new file mode 100644
index 0000000..6406687
--- /dev/null
+++ b/tests/filter/post_fileupload_array_index_blacklist.phpt
@@ -0,0 +1,44 @@
+--TEST--
+suhosin file upload filter (array index character whitelist)
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+file_uploads=1
+suhosin.request.array_index_char_blacklist=ABC
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST_RAW--
+Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="fn[foo][bar]"
+
+ok
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="fn[foo][BAR]"
+
+bad
+-----------------------------20896060251896012921717172737--
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECTF--
+array(1) {
+  ["fn"]=>
+  array(1) {
+    ["foo"]=>
+    array(1) {
+      ["bar"]=>
+      string(2) "ok"
+    }
+  }
+}
+ALERT - array index contains blacklisted characters - dropped variable 'fn[foo][BAR]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 1 request variables - (0 in GET, 1 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_fileupload_array_index_whitelist.phpt b/tests/filter/post_fileupload_array_index_whitelist.phpt
new file mode 100644
index 0000000..80052d6
--- /dev/null
+++ b/tests/filter/post_fileupload_array_index_whitelist.phpt
@@ -0,0 +1,44 @@
+--TEST--
+suhosin file upload filter (array index character whitelist)
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+file_uploads=1
+suhosin.request.array_index_char_whitelist=abcdefghijklmnopqrstuvwxyz
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST_RAW--
+Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="fn[foo][bar]"
+
+ok
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="fn[foo][BAR]"
+
+bad
+-----------------------------20896060251896012921717172737--
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECTF--
+array(1) {
+  ["fn"]=>
+  array(1) {
+    ["foo"]=>
+    array(1) {
+      ["bar"]=>
+      string(2) "ok"
+    }
+  }
+}
+ALERT - array index contains not whitelisted characters - dropped variable 'fn[foo][BAR]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 1 request variables - (0 in GET, 1 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_fileupload_filter_1.phpt b/tests/filter/post_fileupload_filter_1.phpt
new file mode 100644
index 0000000..401b4be
--- /dev/null
+++ b/tests/filter/post_fileupload_filter_1.phpt
@@ -0,0 +1,118 @@
+--TEST--
+suhosin rfc1867 file upload filter (disallowed variable names)
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+file_uploads=1
+upload_max_filesize=1024
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST_RAW--
+Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="HTTP_RAW_POST_DATA"
+
+HTTP_RAW_POST_DATA
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="HTTP_SESSION_VARS"
+
+HTTP_SESSION_VARS
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="HTTP_SERVER_VARS"
+
+HTTP_SERVER_VARS
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="HTTP_COOKIE_VARS"
+
+HTTP_COOKIE_VARS
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="HTTP_POST_FILES"
+
+HTTP_POST_FILES
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="HTTP_POST_VARS"
+
+HTTP_POST_VARS
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="HTTP_GET_VARS"
+
+HTTP_GET_VARS
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="HTTP_ENV_VARS"
+
+HTTP_ENV_VARS
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="_SESSION"
+
+_SESSION
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="_REQUEST"
+
+_REQUEST
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="GLOBALS"
+
+GLOBALS
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="_COOKIE"
+
+_COOKIE
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="_SERVER"
+
+_SERVER
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="_FILES"
+
+_FILES
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="_POST"
+
+_POST
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="_ENV"
+
+_ENV
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="_GET"
+
+_GET
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="harmless"
+
+harmless
+-----------------------------20896060251896012921717172737--
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECTF--
+array(1) {
+  ["harmless"]=>
+  string(8) "harmless"
+}
+ALERT - tried to register forbidden variable 'HTTP_RAW_POST_DATA' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_SESSION_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_SERVER_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_COOKIE_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_POST_FILES' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_POST_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_GET_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_ENV_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_SESSION' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_REQUEST' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'GLOBALS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_COOKIE' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_SERVER' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_FILES' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_POST' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_ENV' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_GET' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 17 request variables - (0 in GET, 17 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
\ No newline at end of file
diff --git a/tests/filter/post_fileupload_filter_2.phpt b/tests/filter/post_fileupload_filter_2.phpt
new file mode 100644
index 0000000..939b7fc
--- /dev/null
+++ b/tests/filter/post_fileupload_filter_2.phpt
@@ -0,0 +1,67 @@
+--TEST--
+suhosin rfc1867 file upload filter (suhosin.post.max_vars)
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.post.max_vars=5
+file_uploads=1
+upload_max_filesize=1024
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST_RAW--
+Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="A"
+
+A
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="B"
+
+B
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="C"
+
+C
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="D"
+
+D
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="E"
+
+E
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="F"
+
+F
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="G"
+
+G
+-----------------------------20896060251896012921717172737--
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECTF--
+array(5) {
+  ["A"]=>
+  string(1) "A"
+  ["B"]=>
+  string(1) "B"
+  ["C"]=>
+  string(1) "C"
+  ["D"]=>
+  string(1) "D"
+  ["E"]=>
+  string(1) "E"
+}
+ALERT - configured POST variable limit exceeded - dropped variable 'F' - all further POST variables are dropped (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 2 request variables - (0 in GET, 2 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_filter_1.phpt b/tests/filter/post_filter_1.phpt
new file mode 100644
index 0000000..16ee164
--- /dev/null
+++ b/tests/filter/post_filter_1.phpt
@@ -0,0 +1,45 @@
+--TEST--
+suhosin POST filter (disallowed variable names)
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST--
+HTTP_RAW_POST_DATA=HTTP_RAW_POST_DATA&HTTP_SESSION_VARS=HTTP_SESSION_VARS&harmless1=harmless1&HTTP_SERVER_VARS=HTTP_SERVER_VARS&HTTP_COOKIE_VARS=HTTP_COOKIE_VARS&HTTP_POST_FILES=HTTP_POST_FILES&HTTP_POST_VARS=HTTP_POST_VARS&HTTP_GET_VARS=HTTP_GET_VARS&HTTP_ENV_VARS=HTTP_ENV_VARS&_SESSION=_SESSION&_REQUEST=_REQUEST&GLOBALS=GLOBALS&_COOKIE=_COOKIE&_SERVER=_SERVER&_FILES=_FILES&_POST=_POST&_ENV=_ENV&_GET=_GET&harmless2=harmless2&
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECTF--
+array(2) {
+  ["harmless1"]=>
+  string(9) "harmless1"
+  ["harmless2"]=>
+  string(9) "harmless2"
+}
+ALERT - tried to register forbidden variable 'HTTP_RAW_POST_DATA' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_SESSION_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_SERVER_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_COOKIE_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_POST_FILES' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_POST_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_GET_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'HTTP_ENV_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_SESSION' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_REQUEST' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable 'GLOBALS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_COOKIE' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_SERVER' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_FILES' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_POST' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_ENV' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - tried to register forbidden variable '_GET' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 17 request variables - (0 in GET, 17 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_filter_2.phpt b/tests/filter/post_filter_2.phpt
new file mode 100644
index 0000000..b70b120
--- /dev/null
+++ b/tests/filter/post_filter_2.phpt
@@ -0,0 +1,36 @@
+--TEST--
+suhosin POST filter (suhosin.post.max_vars)
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.post.max_vars=5
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST--
+A=A&B=B&C=C&D=D&E=E&F=F&G=G&
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECTF--
+array(5) {
+  ["A"]=>
+  string(1) "A"
+  ["B"]=>
+  string(1) "B"
+  ["C"]=>
+  string(1) "C"
+  ["D"]=>
+  string(1) "D"
+  ["E"]=>
+  string(1) "E"
+}
+ALERT - configured POST variable limit exceeded - dropped variable 'F' - all further POST variables are dropped (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 2 request variables - (0 in GET, 2 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_filter_empty_avar.phpt b/tests/filter/post_filter_empty_avar.phpt
new file mode 100644
index 0000000..d09990c
--- /dev/null
+++ b/tests/filter/post_filter_empty_avar.phpt
@@ -0,0 +1,27 @@
+--TEST--
+suhosin POST filter with empty array variable
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.stdout=255
+suhosin.log.script=0
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST--
+a[]=&a[]=test
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECTF--
+array(1) {
+  ["a"]=>
+  array(2) {
+    [0]=>
+    string(0) ""
+    [1]=>
+    string(4) "test"
+  }
+}
diff --git a/tests/filter/post_filter_empty_var.phpt b/tests/filter/post_filter_empty_var.phpt
new file mode 100644
index 0000000..87866e2
--- /dev/null
+++ b/tests/filter/post_filter_empty_var.phpt
@@ -0,0 +1,24 @@
+--TEST--
+suhosin POST filter with empty variable
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.stdout=255
+suhosin.log.script=0
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST--
+A=&B=test
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECTF--
+array(2) {
+  ["A"]=>
+  string(0) ""
+  ["B"]=>
+  string(4) "test"
+}
diff --git a/tests/filter/post_max_array_depth.phpt b/tests/filter/post_max_array_depth.phpt
new file mode 100644
index 0000000..70a5ad6
--- /dev/null
+++ b/tests/filter/post_max_array_depth.phpt
@@ -0,0 +1,66 @@
+--TEST--
+input filter: suhosin.post.max_array_depth
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_array_depth=0
+suhosin.post.max_array_depth=4
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST--
+var1[]=1&var2[][]=2&var3[][][]=3&var4[][][][]=4&var5[][][][][]=5&var6[][][][][][]=6&
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECTF--
+array(4) {
+  ["var1"]=>
+  array(1) {
+    [0]=>
+    string(1) "1"
+  }
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      string(1) "2"
+    }
+  }
+  ["var3"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      array(1) {
+        [0]=>
+        string(1) "3"
+      }
+    }
+  }
+  ["var4"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      array(1) {
+        [0]=>
+        array(1) {
+          [0]=>
+          string(1) "4"
+        }
+      }
+    }
+  }
+}
+ALERT - configured POST variable array depth limit exceeded - dropped variable 'var5[][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured POST variable array depth limit exceeded - dropped variable 'var6[][][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 2 request variables - (0 in GET, 2 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_max_array_depth_rfc1867.phpt b/tests/filter/post_max_array_depth_rfc1867.phpt
new file mode 100644
index 0000000..925878b
--- /dev/null
+++ b/tests/filter/post_max_array_depth_rfc1867.phpt
@@ -0,0 +1,91 @@
+--TEST--
+input filter: suhosin.post.max_array_depth - RFC1867 version
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_array_depth=0
+suhosin.post.max_array_depth=4
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST_RAW--
+Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var1[]"
+
+1
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var2[][]"
+
+2
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var3[][][]"
+
+3
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var4[][][][]"
+
+4
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var5[][][][][]"
+
+5
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var6[][][][][][]"
+
+6
+-----------------------------20896060251896012921717172737--
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECTF--
+array(4) {
+  ["var1"]=>
+  array(1) {
+    [0]=>
+    string(1) "1"
+  }
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      string(1) "2"
+    }
+  }
+  ["var3"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      array(1) {
+        [0]=>
+        string(1) "3"
+      }
+    }
+  }
+  ["var4"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      array(1) {
+        [0]=>
+        array(1) {
+          [0]=>
+          string(1) "4"
+        }
+      }
+    }
+  }
+}
+ALERT - configured POST variable array depth limit exceeded - dropped variable 'var5[][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured POST variable array depth limit exceeded - dropped variable 'var6[][][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 2 request variables - (0 in GET, 2 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_max_array_index_length.phpt b/tests/filter/post_max_array_index_length.phpt
new file mode 100644
index 0000000..9f8404c
--- /dev/null
+++ b/tests/filter/post_max_array_index_length.phpt
@@ -0,0 +1,53 @@
+--TEST--
+input filter: suhosin.post.max_array_index_length
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_array_index_length=0
+suhosin.post.max_array_index_length=3
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST--
+var1[AAA]=1&var2[BBBB]=1&var3[AAA][BBB]=1&var4[AAA][BBBB]=4&var5[AAA][BBB][CCC]=1&var6[AAA][BBBB][CCC]=1
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECTF--
+array(3) {
+  ["var1"]=>
+  array(1) {
+    ["AAA"]=>
+    string(1) "1"
+  }
+  ["var3"]=>
+  array(1) {
+    ["AAA"]=>
+    array(1) {
+      ["BBB"]=>
+      string(1) "1"
+    }
+  }
+  ["var5"]=>
+  array(1) {
+    ["AAA"]=>
+    array(1) {
+      ["BBB"]=>
+      array(1) {
+        ["CCC"]=>
+        string(1) "1"
+      }
+    }
+  }
+}
+ALERT - configured POST variable array index length limit exceeded - dropped variable 'var2[BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured POST variable array index length limit exceeded - dropped variable 'var4[AAA][BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured POST variable array index length limit exceeded - dropped variable 'var6[AAA][BBBB][CCC]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 3 request variables - (0 in GET, 3 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_max_array_index_length_rfc1867.phpt b/tests/filter/post_max_array_index_length_rfc1867.phpt
new file mode 100644
index 0000000..22591f2
--- /dev/null
+++ b/tests/filter/post_max_array_index_length_rfc1867.phpt
@@ -0,0 +1,80 @@
+--TEST--
+input filter: suhosin.post.max_array_index_length - RFC1867 version
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_array_index_length=0
+suhosin.post.max_array_index_length=3
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST--
+var1[AAA]=1&var2[BBBB]=1&var3[AAA][BBB]=1&var4[AAA][BBBB]=4&var5[AAA][BBB][CCC]=1&var6[AAA][BBBB][CCC]=1
+--POST_RAW--
+Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var1[AAA]"
+
+1
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var2[BBBB]"
+
+1
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var3[AAA][BBB]"
+
+1
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var4[AAA][BBBB]"
+
+1
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var5[AAA][BBB][CCC]"
+
+1
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var6[AAA][BBBB][CCC]"
+
+1
+-----------------------------20896060251896012921717172737--
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECTF--
+array(3) {
+  ["var1"]=>
+  array(1) {
+    ["AAA"]=>
+    string(1) "1"
+  }
+  ["var3"]=>
+  array(1) {
+    ["AAA"]=>
+    array(1) {
+      ["BBB"]=>
+      string(1) "1"
+    }
+  }
+  ["var5"]=>
+  array(1) {
+    ["AAA"]=>
+    array(1) {
+      ["BBB"]=>
+      array(1) {
+        ["CCC"]=>
+        string(1) "1"
+      }
+    }
+  }
+}
+ALERT - configured POST variable array index length limit exceeded - dropped variable 'var2[BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured POST variable array index length limit exceeded - dropped variable 'var4[AAA][BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured POST variable array index length limit exceeded - dropped variable 'var6[AAA][BBBB][CCC]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 3 request variables - (0 in GET, 3 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
\ No newline at end of file
diff --git a/tests/filter/post_max_name_length.phpt b/tests/filter/post_max_name_length.phpt
new file mode 100644
index 0000000..701356e
--- /dev/null
+++ b/tests/filter/post_max_name_length.phpt
@@ -0,0 +1,43 @@
+--TEST--
+input filter: suhosin.post.max_name_length
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_varname_length=0
+suhosin.post.max_name_length=4
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST--
+var=0&var1=1&var2[]=2&var3[xxx]=3&var04=4&var05[]=5&var06[xxx]=6&
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECTF--
+array(4) {
+  ["var"]=>
+  string(1) "0"
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    string(1) "2"
+  }
+  ["var3"]=>
+  array(1) {
+    ["xxx"]=>
+    string(1) "3"
+  }
+}
+ALERT - configured POST variable name length limit exceeded - dropped variable 'var04' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured POST variable name length limit exceeded - dropped variable 'var05[]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured POST variable name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 3 request variables - (0 in GET, 3 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_max_name_length_rfc1867.phpt b/tests/filter/post_max_name_length_rfc1867.phpt
new file mode 100644
index 0000000..0316f17
--- /dev/null
+++ b/tests/filter/post_max_name_length_rfc1867.phpt
@@ -0,0 +1,72 @@
+--TEST--
+input filter: suhosin.post.max_name_length - RFC1867 version
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_varname_length=0
+suhosin.post.max_name_length=4
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST_RAW--
+Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var"
+
+0
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var1"
+
+1
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var2[]"
+
+2
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var3[xxx]"
+
+3
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var04"
+
+4
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var05[]"
+
+5
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var06[xxx]"
+
+6
+-----------------------------20896060251896012921717172737--
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECTF--
+array(4) {
+  ["var"]=>
+  string(1) "0"
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    string(1) "2"
+  }
+  ["var3"]=>
+  array(1) {
+    ["xxx"]=>
+    string(1) "3"
+  }
+}
+ALERT - configured POST variable name length limit exceeded - dropped variable 'var04' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured POST variable name length limit exceeded - dropped variable 'var05[]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured POST variable name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 3 request variables - (0 in GET, 3 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_max_totalname_length.phpt b/tests/filter/post_max_totalname_length.phpt
new file mode 100644
index 0000000..eb6cfb5
--- /dev/null
+++ b/tests/filter/post_max_totalname_length.phpt
@@ -0,0 +1,44 @@
+--TEST--
+input filter: suhosin.post.max_totalname_length
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_totalname_length=0
+suhosin.post.max_totalname_length=7
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST--
+var=0&var1=1&var2[]=2&var3[xxx]=3&var04=4&var05[]=5&var06[xxx]=6&
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECTF--
+array(5) {
+  ["var"]=>
+  string(1) "0"
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    string(1) "2"
+  }
+  ["var04"]=>
+  string(1) "4"
+  ["var05"]=>
+  array(1) {
+    [0]=>
+    string(1) "5"
+  }
+}
+ALERT - configured POST variable total name length limit exceeded - dropped variable 'var3[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured POST variable total name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 2 request variables - (0 in GET, 2 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_max_totalname_length_rfc1867.phpt b/tests/filter/post_max_totalname_length_rfc1867.phpt
new file mode 100644
index 0000000..efcface
--- /dev/null
+++ b/tests/filter/post_max_totalname_length_rfc1867.phpt
@@ -0,0 +1,73 @@
+--TEST--
+input filter: suhosin.post.max_totalname_length - RFC1867 version
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_totalname_length=0
+suhosin.post.max_totalname_length=7
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST_RAW--
+Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var"
+
+0
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var1"
+
+1
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var2[]"
+
+2
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var3[xxx]"
+
+3
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var04"
+
+4
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var05[]"
+
+5
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="var06[xxx]"
+
+6
+-----------------------------20896060251896012921717172737--
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECTF--
+array(5) {
+  ["var"]=>
+  string(1) "0"
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    string(1) "2"
+  }
+  ["var04"]=>
+  string(1) "4"
+  ["var05"]=>
+  array(1) {
+    [0]=>
+    string(1) "5"
+  }
+}
+ALERT - configured POST variable total name length limit exceeded - dropped variable 'var3[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured POST variable total name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 2 request variables - (0 in GET, 2 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_max_value_length.phpt b/tests/filter/post_max_value_length.phpt
new file mode 100644
index 0000000..cd5da3b
--- /dev/null
+++ b/tests/filter/post_max_value_length.phpt
@@ -0,0 +1,36 @@
+--TEST--
+input filter: suhosin.post.max_value_length
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_value_length=0
+suhosin.post.max_value_length=3
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST--
+var1=1&var2=22&var3=333&var4=4444&var5=55%00555&var6=666666&
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECTF--
+array(3) {
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  string(2) "22"
+  ["var3"]=>
+  string(3) "333"
+}
+ALERT - configured POST variable value length limit exceeded - dropped variable 'var4' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured POST variable value length limit exceeded - dropped variable 'var5' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured POST variable value length limit exceeded - dropped variable 'var6' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 3 request variables - (0 in GET, 3 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
+
diff --git a/tests/filter/post_max_value_length_rfc1867.phpt b/tests/filter/post_max_value_length_rfc1867.phpt
new file mode 100644
index 0000000..6d807f4
--- /dev/null
+++ b/tests/filter/post_max_value_length_rfc1867.phpt
diff --git a/tests/filter/request_array_index_blacklist.phpt b/tests/filter/request_array_index_blacklist.phpt
new file mode 100644
index 0000000..c24316e
--- /dev/null
+++ b/tests/filter/request_array_index_blacklist.phpt
@@ -0,0 +1,56 @@
+--TEST--
+input filter: suhosin.request.array_index_blacklist
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.array_index_char_blacklist="=ABC%{}\\$;"
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+var1[aaa]=1;var2[bbB]=1;var3[ccc][ccC]=1
+--GET--
+var1[aaa]=1&var2[bbB]=1&var3[ccc][ccC]=1
+--POST--
+var1[aaa]=1&var2[bbB]=1&var3[ccc][ccC]=1
+--FILE--
+<?php
+var_dump(ini_get("suhosin.request.array_index_char_blacklist"));
+var_dump($_GET);
+var_dump($_POST);
+var_dump($_COOKIE);
+?>
+--EXPECTF--
+string(10) "=ABC%{}\$;"
+array(1) {
+  ["var1"]=>
+  array(1) {
+    ["aaa"]=>
+    string(1) "1"
+  }
+}
+array(1) {
+  ["var1"]=>
+  array(1) {
+    ["aaa"]=>
+    string(1) "1"
+  }
+}
+array(1) {
+  ["var1"]=>
+  array(1) {
+    ["aaa"]=>
+    string(1) "1"
+  }
+}
+ALERT - array index contains blacklisted characters - dropped variable 'var2[bbB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - array index contains blacklisted characters - dropped variable 'var3[ccc][ccC]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - array index contains blacklisted characters - dropped variable 'var2[bbB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - array index contains blacklisted characters - dropped variable 'var3[ccc][ccC]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - array index contains blacklisted characters - dropped variable 'var2[bbB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - array index contains blacklisted characters - dropped variable 'var3[ccc][ccC]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 6 request variables - (2 in GET, 2 in POST, 2 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/request_array_index_whitelist.phpt b/tests/filter/request_array_index_whitelist.phpt
new file mode 100644
index 0000000..31d8efc
--- /dev/null
+++ b/tests/filter/request_array_index_whitelist.phpt
@@ -0,0 +1,54 @@
+--TEST--
+input filter: suhosin.request.array_index_whitelist
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.array_index_char_whitelist=abcdefghijklmnopqrstuvwxyz
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+var1[aaa]=1;var2[bbB]=1;var3[ccc][ccC]=1
+--GET--
+var1[aaa]=1&var2[bbB]=1&var3[ccc][ccC]=1
+--POST--
+var1[aaa]=1&var2[bbB]=1&var3[ccc][ccC]=1
+--FILE--
+<?php
+var_dump($_GET);
+var_dump($_POST);
+var_dump($_COOKIE);
+?>
+--EXPECTF--
+array(1) {
+  ["var1"]=>
+  array(1) {
+    ["aaa"]=>
+    string(1) "1"
+  }
+}
+array(1) {
+  ["var1"]=>
+  array(1) {
+    ["aaa"]=>
+    string(1) "1"
+  }
+}
+array(1) {
+  ["var1"]=>
+  array(1) {
+    ["aaa"]=>
+    string(1) "1"
+  }
+}
+ALERT - array index contains not whitelisted characters - dropped variable 'var2[bbB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - array index contains not whitelisted characters - dropped variable 'var3[ccc][ccC]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - array index contains not whitelisted characters - dropped variable 'var2[bbB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - array index contains not whitelisted characters - dropped variable 'var3[ccc][ccC]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - array index contains not whitelisted characters - dropped variable 'var2[bbB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - array index contains not whitelisted characters - dropped variable 'var3[ccc][ccC]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 6 request variables - (2 in GET, 2 in POST, 2 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/request_disallow_nul.phpt b/tests/filter/request_disallow_nul.phpt
new file mode 100644
index 0000000..621eda7
--- /dev/null
+++ b/tests/filter/request_disallow_nul.phpt
@@ -0,0 +1,51 @@
+--TEST--
+input filter: suhosin.request.disallow_nul
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.disallow_nul=1
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+var1=xx%001;var2=2;var3=xx%003;var4=4;
+--GET--
+var1=xx%001&var2=2&var3=xx%003&var4=4&
+--POST--
+var1=xx%001&var2=2&var3=xx%003&var4=4&
+--FILE--
+<?php
+var_dump($_GET);
+var_dump($_POST);
+var_dump($_COOKIE);
+?>
+--EXPECTF--
+array(2) {
+  ["var2"]=>
+  string(1) "2"
+  ["var4"]=>
+  string(1) "4"
+}
+array(2) {
+  ["var2"]=>
+  string(1) "2"
+  ["var4"]=>
+  string(1) "4"
+}
+array(2) {
+  ["var2"]=>
+  string(1) "2"
+  ["var4"]=>
+  string(1) "4"
+}
+ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'var1' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'var3' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'var1' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'var3' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'var1' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'var3' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 6 request variables - (2 in GET, 2 in POST, 2 in COOKIE) (attacker 'REMOTE_ADDR not set', file %s)
diff --git a/tests/filter/request_disallow_ws.phpt b/tests/filter/request_disallow_ws.phpt
new file mode 100644
index 0000000..99041b8
--- /dev/null
+++ b/tests/filter/request_disallow_ws.phpt
@@ -0,0 +1,30 @@
+--TEST--
+input filter: suhosin.request.disallow_ws
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.disallow_ws=1
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
++var1=1&var2=2&%20var3=3& var4=4&
+--POST--
+--FILE--
+<?php
+var_dump($_GET);
+?>
+--EXPECTF--
+array(1) {
+  ["var2"]=>
+  string(1) "2"
+}
+ALERT - request variable name begins with disallowed whitespace - dropped variable ' var1' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - request variable name begins with disallowed whitespace - dropped variable ' var3' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - request variable name begins with disallowed whitespace - dropped variable ' var4' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 3 request variables - (3 in GET, 0 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', file %s)
diff --git a/tests/filter/request_max_array_depth.phpt b/tests/filter/request_max_array_depth.phpt
new file mode 100644
index 0000000..7782a4c
--- /dev/null
+++ b/tests/filter/request_max_array_depth.phpt
@@ -0,0 +1,153 @@
+--TEST--
+input filter: suhosin.request.max_array_depth
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_array_depth=4
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+var1[]=1;var2[][]=2;var3[][][]=3;var4[][][][]=4;var5[][][][][]=5;var6[][][][][][]=6;
+--GET--
+var1[]=1&var2[][]=2&var3[][][]=3&var4[][][][]=4&var5[][][][][]=5&var6[][][][][][]=6&
+--POST--
+var1[]=1&var2[][]=2&var3[][][]=3&var4[][][][]=4&var5[][][][][]=5&var6[][][][][][]=6&
+--FILE--
+<?php
+var_dump($_GET);
+var_dump($_POST);
+var_dump($_COOKIE);
+?>
+--EXPECTF--
+array(4) {
+  ["var1"]=>
+  array(1) {
+    [0]=>
+    string(1) "1"
+  }
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      string(1) "2"
+    }
+  }
+  ["var3"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      array(1) {
+        [0]=>
+        string(1) "3"
+      }
+    }
+  }
+  ["var4"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      array(1) {
+        [0]=>
+        array(1) {
+          [0]=>
+          string(1) "4"
+        }
+      }
+    }
+  }
+}
+array(4) {
+  ["var1"]=>
+  array(1) {
+    [0]=>
+    string(1) "1"
+  }
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      string(1) "2"
+    }
+  }
+  ["var3"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      array(1) {
+        [0]=>
+        string(1) "3"
+      }
+    }
+  }
+  ["var4"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      array(1) {
+        [0]=>
+        array(1) {
+          [0]=>
+          string(1) "4"
+        }
+      }
+    }
+  }
+}
+array(4) {
+  ["var1"]=>
+  array(1) {
+    [0]=>
+    string(1) "1"
+  }
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      string(1) "2"
+    }
+  }
+  ["var3"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      array(1) {
+        [0]=>
+        string(1) "3"
+      }
+    }
+  }
+  ["var4"]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      array(1) {
+        [0]=>
+        array(1) {
+          [0]=>
+          string(1) "4"
+        }
+      }
+    }
+  }
+}
+ALERT - configured request variable array depth limit exceeded - dropped variable 'var5[][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable array depth limit exceeded - dropped variable 'var6[][][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable array depth limit exceeded - dropped variable 'var5[][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable array depth limit exceeded - dropped variable 'var6[][][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable array depth limit exceeded - dropped variable 'var5[][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable array depth limit exceeded - dropped variable 'var6[][][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 6 request variables - (2 in GET, 2 in POST, 2 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/request_max_array_index_length.phpt b/tests/filter/request_max_array_index_length.phpt
new file mode 100644
index 0000000..eefa501
--- /dev/null
+++ b/tests/filter/request_max_array_index_length.phpt
@@ -0,0 +1,114 @@
+--TEST--
+input filter: suhosin.request.max_array_index_length
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_array_index_length=3
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+var1[AAA]=1;var2[BBBB]=1;var3[AAA][BBB]=1;var4[AAA][BBBB]=4;var5[AAA][BBB][CCC]=1;var6[AAA][BBBB][CCC]=1;
+--GET--
+var1[AAA]=1&var2[BBBB]=1&var3[AAA][BBB]=1&var4[AAA][BBBB]=4&var5[AAA][BBB][CCC]=1&var6[AAA][BBBB][CCC]=1
+--POST--
+var1[AAA]=1&var2[BBBB]=1&var3[AAA][BBB]=1&var4[AAA][BBBB]=4&var5[AAA][BBB][CCC]=1&var6[AAA][BBBB][CCC]=1
+--FILE--
+<?php
+var_dump($_GET);
+var_dump($_POST);
+var_dump($_COOKIE);
+?>
+--EXPECTF--
+array(3) {
+  ["var1"]=>
+  array(1) {
+    ["AAA"]=>
+    string(1) "1"
+  }
+  ["var3"]=>
+  array(1) {
+    ["AAA"]=>
+    array(1) {
+      ["BBB"]=>
+      string(1) "1"
+    }
+  }
+  ["var5"]=>
+  array(1) {
+    ["AAA"]=>
+    array(1) {
+      ["BBB"]=>
+      array(1) {
+        ["CCC"]=>
+        string(1) "1"
+      }
+    }
+  }
+}
+array(3) {
+  ["var1"]=>
+  array(1) {
+    ["AAA"]=>
+    string(1) "1"
+  }
+  ["var3"]=>
+  array(1) {
+    ["AAA"]=>
+    array(1) {
+      ["BBB"]=>
+      string(1) "1"
+    }
+  }
+  ["var5"]=>
+  array(1) {
+    ["AAA"]=>
+    array(1) {
+      ["BBB"]=>
+      array(1) {
+        ["CCC"]=>
+        string(1) "1"
+      }
+    }
+  }
+}
+array(3) {
+  ["var1"]=>
+  array(1) {
+    ["AAA"]=>
+    string(1) "1"
+  }
+  ["var3"]=>
+  array(1) {
+    ["AAA"]=>
+    array(1) {
+      ["BBB"]=>
+      string(1) "1"
+    }
+  }
+  ["var5"]=>
+  array(1) {
+    ["AAA"]=>
+    array(1) {
+      ["BBB"]=>
+      array(1) {
+        ["CCC"]=>
+        string(1) "1"
+      }
+    }
+  }
+}
+ALERT - configured request variable array index length limit exceeded - dropped variable 'var2[BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable array index length limit exceeded - dropped variable 'var4[AAA][BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable array index length limit exceeded - dropped variable 'var6[AAA][BBBB][CCC]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable array index length limit exceeded - dropped variable 'var2[BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable array index length limit exceeded - dropped variable 'var4[AAA][BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable array index length limit exceeded - dropped variable 'var6[AAA][BBBB][CCC]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable array index length limit exceeded - dropped variable 'var2[BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable array index length limit exceeded - dropped variable 'var4[AAA][BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable array index length limit exceeded - dropped variable 'var6[AAA][BBBB][CCC]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 9 request variables - (3 in GET, 3 in POST, 3 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
\ No newline at end of file
diff --git a/tests/filter/request_max_name_length.phpt b/tests/filter/request_max_name_length.phpt
new file mode 100644
index 0000000..34f7915
--- /dev/null
+++ b/tests/filter/request_max_name_length.phpt
@@ -0,0 +1,85 @@
+--TEST--
+input filter: suhosin.request.max_varname_length
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_varname_length=4
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+var=0;var1=1;var2[]=2;var3[xxx]=3;var04=4;var05[]=5;var06[xxx]=6;
+--GET--
+var=0&var1=1&var2[]=2&var3[xxx]=3&var04=4&var05[]=5&var06[xxx]=6&
+--POST--
+var=0&var1=1&var2[]=2&var3[xxx]=3&var04=4&var05[]=5&var06[xxx]=6&
+--FILE--
+<?php
+var_dump($_GET);
+var_dump($_POST);
+var_dump($_COOKIE);
+?>
+--EXPECTF--
+array(4) {
+  ["var"]=>
+  string(1) "0"
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    string(1) "2"
+  }
+  ["var3"]=>
+  array(1) {
+    ["xxx"]=>
+    string(1) "3"
+  }
+}
+array(4) {
+  ["var"]=>
+  string(1) "0"
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    string(1) "2"
+  }
+  ["var3"]=>
+  array(1) {
+    ["xxx"]=>
+    string(1) "3"
+  }
+}
+array(4) {
+  ["var"]=>
+  string(1) "0"
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    string(1) "2"
+  }
+  ["var3"]=>
+  array(1) {
+    ["xxx"]=>
+    string(1) "3"
+  }
+}
+ALERT - configured request variable name length limit exceeded - dropped variable 'var04' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable name length limit exceeded - dropped variable 'var05[]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable name length limit exceeded - dropped variable 'var04' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable name length limit exceeded - dropped variable 'var05[]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable name length limit exceeded - dropped variable 'var04' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable name length limit exceeded - dropped variable 'var05[]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 9 request variables - (3 in GET, 3 in POST, 3 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
+
diff --git a/tests/filter/request_max_totalname_length.phpt b/tests/filter/request_max_totalname_length.phpt
new file mode 100644
index 0000000..c4a415f
--- /dev/null
+++ b/tests/filter/request_max_totalname_length.phpt
@@ -0,0 +1,87 @@
+--TEST--
+input filter: suhosin.request.max_totalname_length
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.request.max_totalname_length=7
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+var=0;var1=1;var2[]=2;var3[xxx]=3;var04=4;var05[]=5;var06[xxx]=6;
+--GET--
+var=0&var1=1&var2[]=2&var3[xxx]=3&var04=4&var05[]=5&var06[xxx]=6&
+--POST--
+var=0&var1=1&var2[]=2&var3[xxx]=3&var04=4&var05[]=5&var06[xxx]=6&
+--FILE--
+<?php
+var_dump($_GET);
+var_dump($_POST);
+var_dump($_COOKIE);
+?>
+--EXPECTF--
+array(5) {
+  ["var"]=>
+  string(1) "0"
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    string(1) "2"
+  }
+  ["var04"]=>
+  string(1) "4"
+  ["var05"]=>
+  array(1) {
+    [0]=>
+    string(1) "5"
+  }
+}
+array(5) {
+  ["var"]=>
+  string(1) "0"
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    string(1) "2"
+  }
+  ["var04"]=>
+  string(1) "4"
+  ["var05"]=>
+  array(1) {
+    [0]=>
+    string(1) "5"
+  }
+}
+array(5) {
+  ["var"]=>
+  string(1) "0"
+  ["var1"]=>
+  string(1) "1"
+  ["var2"]=>
+  array(1) {
+    [0]=>
+    string(1) "2"
+  }
+  ["var04"]=>
+  string(1) "4"
+  ["var05"]=>
+  array(1) {
+    [0]=>
+    string(1) "5"
+  }
+}
+ALERT - configured request variable total name length limit exceeded - dropped variable 'var3[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable total name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable total name length limit exceeded - dropped variable 'var3[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable total name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable total name length limit exceeded - dropped variable 'var3[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - configured request variable total name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
+ALERT - dropped 6 request variables - (2 in GET, 2 in POST, 2 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/server_encode_off.phpt b/tests/filter/server_encode_off.phpt
new file mode 100644
index 0000000..69793fd
--- /dev/null
+++ b/tests/filter/server_encode_off.phpt
@@ -0,0 +1,31 @@
+--TEST--
+Testing: suhosin.server.encode=Off
+--DESCRIPTION--
+This test is incomplete but at the moment we cannot do better with the standard test framework.
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.stdout=255
+suhosin.log.script=0
+suhosin.server.encode=Off
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--ENV--
+return <<<END
+REQUEST_URI=AAA<>"'`!AAA
+END;
+--COOKIE--
+--GET--
+BBB<>"'`!BBB
+--POST--
+--FILE--
+<?php
+// THIS TEST IS INCOMPLETE!!! SEE DESCRIPTION
+var_dump($_SERVER['REQUEST_URI']);
+var_dump($_SERVER['QUERY_STRING']);
+?>
+--EXPECTF--
+string(12) "AAA<>"'`!AAA"
+string(12) "BBB<>"'`!BBB"
+
+
diff --git a/tests/filter/server_encode_on.phpt b/tests/filter/server_encode_on.phpt
new file mode 100644
index 0000000..3b02ce4
--- /dev/null
+++ b/tests/filter/server_encode_on.phpt
@@ -0,0 +1,30 @@
+--TEST--
+Testing: suhosin.server.encode=On
+--DESCRIPTION--
+This test is incomplete but at the moment we cannot do better with the standard test framework.
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.stdout=255
+suhosin.log.script=0
+suhosin.server.encode=On
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--ENV--
+return <<<END
+REQUEST_URI=AAA<>"'`!AAA
+END;
+--COOKIE--
+--GET--
+BBB<>"'`!BBB
+--POST--
+--FILE--
+<?php
+// THIS TEST IS INCOMPLETE!!! SEE DESCRIPTION
+var_dump($_SERVER['REQUEST_URI']);
+var_dump($_SERVER['QUERY_STRING']);
+?>
+--EXPECTF--
+string(22) "AAA%3C%3E%22%27%60!AAA"
+string(22) "BBB%3C%3E%22%27%60!BBB"
+
diff --git a/tests/filter/server_filter.phpt b/tests/filter/server_filter.phpt
new file mode 100644
index 0000000..f2afdf7
--- /dev/null
+++ b/tests/filter/server_filter.phpt
@@ -0,0 +1,36 @@
+--TEST--
+suhosin SERVER filter
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--ENV--
+return <<<END
+HTTP_POST_VARS=HTTP_POST_VARS
+HTTP_MY_VARS=HTTP_MY_VARS
+HTTP_GET_VARS=HTTP_GET_VARS
+HTTP_ENV_VARS=HTTP_ENV_VARS
+HTTP_SERVER_VARS=HTTP_SERVER_VARS
+HTTP_SESSION_VARS=HTTP_SESSION_VARS
+HTTP_COOKIE_VARS=HTTP_COOKIE_VARS
+HTTP_RAW_POST_DATA=HTTP_RAW_POST_DATA
+HTTP_POST_FILES=HTTP_POST_FILES
+END;
+--COOKIE--
+--GET--
+--POST--
+--FILE--
+<?php
+foreach ($_SERVER as $k => $v) {
+        if (!strncmp($k, "HTTP_", 5)) echo "$k => $v\n";
+}
+?>
+--EXPECTF--
+HTTP_MY_VARS => HTTP_MY_VARS
+ALERT - Attacker tried to overwrite a superglobal through a HTTP header (attacker 'REMOTE_ADDR not set', file '%s')
\ No newline at end of file
diff --git a/tests/filter/server_strip_off.phpt b/tests/filter/server_strip_off.phpt
new file mode 100644
index 0000000..57b2e97
--- /dev/null
+++ b/tests/filter/server_strip_off.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Testing: suhosin.server.strip=Off
+--DESCRIPTION--
+This test is incomplete but at the moment we cannot do better with the standard test framework.
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.stdout=255
+suhosin.log.script=0
+suhosin.server.strip=Off
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--ENV--
+return <<<END
+SCRIPT_NAME=X/index.php/THIS_IS_A_FAKE_NAME<>"'`!AAA
+END;
+--COOKIE--
+--GET--
+A=B
+--POST--
+--FILE--
+<?php
+// THIS TEST IS INCOMPLETE!!! SEE DESCRIPTION
+var_dump($_SERVER['PHP_SELF']);
+?>
+--EXPECTF--
+string(40) "X/index.php/THIS_IS_A_FAKE_NAME<>"'`!AAA"
diff --git a/tests/filter/server_strip_on.phpt b/tests/filter/server_strip_on.phpt
new file mode 100644
index 0000000..9e9d991
--- /dev/null
+++ b/tests/filter/server_strip_on.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Testing: suhosin.server.strip=On
+--DESCRIPTION--
+This test is incomplete but at the moment we cannot do better with the standard test framework.
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.stdout=255
+suhosin.log.script=0
+suhosin.server.strip=On
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--ENV--
+return <<<END
+SCRIPT_NAME=X/index.php/THIS_IS_A_FAKE_NAME<>"'`!AAA
+END;
+--COOKIE--
+--GET--
+A=B
+--POST--
+--FILE--
+<?php
+// THIS TEST IS INCOMPLETE!!! SEE DESCRIPTION
+var_dump($_SERVER['PHP_SELF']);
+?>
+--EXPECTF--
+string(40) "X/index.php/THIS_IS_A_FAKE_NAME?????!AAA"
diff --git a/tests/filter/server_user_agent_strip_off.phpt b/tests/filter/server_user_agent_strip_off.phpt
new file mode 100644
index 0000000..1f58007
--- /dev/null
+++ b/tests/filter/server_user_agent_strip_off.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Testing: suhosin.server.strip=On
+--DESCRIPTION--
+This test is not exactly what we want, but good enough due to limitations of the test framework.
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.stdout=255
+suhosin.log.script=0
+suhosin.server.strip=Off
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--ENV--
+return <<<END
+HTTP_USER_AGENT=Mozilla/5.0 (Windows NT 6.0; rv:29.0) <script>alert('123');</script>Gecko/20100101 Firefox/29.0
+END;
+--COOKIE--
+--GET--
+A=B
+--POST--
+--FILE--
+<?php
+var_dump($_SERVER['HTTP_USER_AGENT']);
+?>
+--EXPECTF--
+string(95) "Mozilla/5.0 (Windows NT 6.0; rv:29.0) <script>alert('123');</script>Gecko/20100101 Firefox/29.0"
+
diff --git a/tests/filter/server_user_agent_strip_on.phpt b/tests/filter/server_user_agent_strip_on.phpt
new file mode 100644
index 0000000..df1d040
--- /dev/null
+++ b/tests/filter/server_user_agent_strip_on.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Testing: suhosin.server.strip=On
+--DESCRIPTION--
+This test is not exactly what we want, but good enough due to limitations of the test framework.
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.stdout=255
+suhosin.log.script=0
+suhosin.server.strip=On
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--ENV--
+return <<<END
+HTTP_USER_AGENT=Mozilla/5.0 (Windows NT 6.0; rv:29.0) <script>alert('123');</script>Gecko/20100101 Firefox/29.0
+END;
+--COOKIE--
+--GET--
+A=B
+--POST--
+--FILE--
+<?php
+var_dump($_SERVER['HTTP_USER_AGENT']);
+?>
+--EXPECTF--
+string(95) "Mozilla/5.0 (Windows NT 6.0; rv:29.0) ?script?alert(?123?);?/script?Gecko/20100101 Firefox/29.0"
+
diff --git a/tests/filter/suhosin_upload_disallow_binary_off.phpt b/tests/filter/suhosin_upload_disallow_binary_off.phpt
new file mode 100644
index 0000000..bcb76be
--- /dev/null
+++ b/tests/filter/suhosin_upload_disallow_binary_off.phpt
diff --git a/tests/filter/suhosin_upload_disallow_binary_on.phpt b/tests/filter/suhosin_upload_disallow_binary_on.phpt
new file mode 100644
index 0000000..bc2c7ea
--- /dev/null
+++ b/tests/filter/suhosin_upload_disallow_binary_on.phpt
diff --git a/tests/filter/suhosin_upload_disallow_binary_utf8.phpt b/tests/filter/suhosin_upload_disallow_binary_utf8.phpt
new file mode 100644
index 0000000..d14f041
--- /dev/null
+++ b/tests/filter/suhosin_upload_disallow_binary_utf8.phpt
@@ -0,0 +1,46 @@
+--TEST--
+Testing: suhosin.upload.disallow_binary=On with UTF-8
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.stdout=255
+suhosin.log.script=0
+file_uploads=1
+suhosin.upload.disallow_binary=On
+suhosin.upload.allow_utf8=On
+max_file_uploads=40
+suhosin.upload.max_uploads=40
+--SKIPIF--
+<?php include('../skipif.inc');
+if (ini_get('suhosin.upload.allow_utf8') === FALSE) { die("skip feature not compiled in"); }
+?>
+--COOKIE--
+--GET--
+--POST_RAW--
+Content-Type: multipart/form-data; boundary=bound
+--bound
+Content-Disposition: form-data; name="test"; filename="test"
+
+Spaß am Gerät!
+
+--bound--
+--FILE--
+<?php
+var_dump($_FILES);
+?>
+--EXPECTF--
+array(1) {
+  ["test"]=>
+  array(5) {
+    ["name"]=>
+    string(4) "test"
+    ["type"]=>
+    string(0) ""
+    ["tmp_name"]=>
+    string(%d) "%s"
+    ["error"]=>
+    int(0)
+    ["size"]=>
+    int(17)
+  }
+}
diff --git a/tests/filter/suhosin_upload_disallow_binary_utf8fail.phpt b/tests/filter/suhosin_upload_disallow_binary_utf8fail.phpt
new file mode 100644
index 0000000..95e4864
--- /dev/null
+++ b/tests/filter/suhosin_upload_disallow_binary_utf8fail.phpt
@@ -0,0 +1,50 @@
+--TEST--
+Testing: suhosin.upload.disallow_binary=On with UTF-8 and allow_utf8=Off
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+file_uploads=1
+suhosin.upload.disallow_binary=On
+suhosin.upload.allow_utf8=Off
+max_file_uploads=40
+suhosin.upload.max_uploads=40
+--SKIPIF--
+<?php include('../skipif.inc');
+if (ini_get('suhosin.upload.allow_utf8') === FALSE) { die("skip feature not compiled in"); }
+?>
+--COOKIE--
+--GET--
+--POST_RAW--
+Content-Type: multipart/form-data; boundary=bound
+--bound
+Content-Disposition: form-data; name="test"; filename="test"
+
+Spaß am Gerät!
+
+--bound--
+--FILE--
+<?php
+var_dump($_FILES);
+?>
+--EXPECTF--
+array(1) {
+  ["test"]=>
+  array(5) {
+    ["name"]=>
+    string(4) "test"
+    ["type"]=>
+    string(0) ""
+    ["tmp_name"]=>
+    string(0) ""
+    ["error"]=>
+    int(8)
+    ["size"]=>
+    int(0)
+  }
+}
+ALERT - uploaded file contains binary data - file dropped (attacker 'REMOTE_ADDR not set', file '%s')
diff --git a/tests/filter/suhosin_upload_disallow_elf.phpt b/tests/filter/suhosin_upload_disallow_elf.phpt
new file mode 100644
index 0000000..7b074f7
--- /dev/null
+++ b/tests/filter/suhosin_upload_disallow_elf.phpt
@@ -0,0 +1,61 @@
+--TEST--
+Testing: suhosin.upload.disallow_elf=On
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+file_uploads=1
+suhosin.upload.disallow_elf=On
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST_RAW--
+Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="A"; filename="A"
+
+ELFABCDEFGHIJKLMN
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="B"; filename="B"
+
+XELFABCDEFGHIJKLMN
+-----------------------------20896060251896012921717172737--
+--FILE--
+<?php
+var_dump($_FILES);
+?>
+--EXPECTF--
+array(2) {
+  ["A"]=>
+  array(5) {
+    ["name"]=>
+    string(1) "A"
+    ["type"]=>
+    string(0) ""
+    ["tmp_name"]=>
+    string(0) ""
+    ["error"]=>
+    int(8)
+    ["size"]=>
+    int(0)
+  }
+  ["B"]=>
+  array(5) {
+    ["name"]=>
+    string(1) "B"
+    ["type"]=>
+    string(0) ""
+    ["tmp_name"]=>
+    string(%d) "%s"
+    ["error"]=>
+    int(0)
+    ["size"]=>
+    int(18)
+  }
+}
+ALERT - uploaded file is an ELF executable - file dropped (attacker 'REMOTE_ADDR not set', file '%s')
\ No newline at end of file
diff --git a/tests/filter/suhosin_upload_disallow_elf_off.phpt b/tests/filter/suhosin_upload_disallow_elf_off.phpt
new file mode 100644
index 0000000..832692c
--- /dev/null
+++ b/tests/filter/suhosin_upload_disallow_elf_off.phpt
@@ -0,0 +1,57 @@
+--TEST--
+Testing: suhosin.upload.disallow_elf=Off
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.stdout=255
+suhosin.log.script=0
+file_uploads=1
+suhosin.upload.disallow_elf=Off
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST_RAW--
+Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="A"; filename="A"
+
+ELFABCDEFGHIJKLMN
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="B"; filename="B"
+
+XELFABCDEFGHIJKLMN
+-----------------------------20896060251896012921717172737--
+--FILE--
+<?php
+var_dump($_FILES);
+?>
+--EXPECTF--
+array(2) {
+  ["A"]=>
+  array(5) {
+    ["name"]=>
+    string(1) "A"
+    ["type"]=>
+    string(0) ""
+    ["tmp_name"]=>
+    string(%d) "%s"
+    ["error"]=>
+    int(0)
+    ["size"]=>
+    int(18)
+  }
+  ["B"]=>
+  array(5) {
+    ["name"]=>
+    string(1) "B"
+    ["type"]=>
+    string(0) ""
+    ["tmp_name"]=>
+    string(%d) "%s"
+    ["error"]=>
+    int(0)
+    ["size"]=>
+    int(18)
+  }
+}
\ No newline at end of file
diff --git a/tests/filter/suhosin_upload_max_uploads.phpt b/tests/filter/suhosin_upload_max_uploads.phpt
new file mode 100644
index 0000000..fb6f249
--- /dev/null
+++ b/tests/filter/suhosin_upload_max_uploads.phpt
@@ -0,0 +1,87 @@
+--TEST--
+suhosin.upload.max_uploads
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.script=0
+suhosin.log.file=255
+suhosin.log.file.time=0
+suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
+auto_append_file={PWD}/suhosintest.$$.log.tmp
+suhosin.post.max_vars=5
+file_uploads=1
+suhosin.upload.max_uploads=3
+--SKIPIF--
+<?php include('../skipif.inc'); ?>
+--COOKIE--
+--GET--
+--POST_RAW--
+Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="A"; filename="A"
+
+A
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="B"; filename="B"
+
+B
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="C"; filename="C"
+
+C
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="D"; filename="D"
+
+D
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="E"; filename="E"
+
+E
+-----------------------------20896060251896012921717172737--
+--FILE--
+<?php
+var_dump($_FILES);
+?>
+--EXPECTF--
+array(3) {
+  ["A"]=>
+  array(5) {
+    ["name"]=>
+    string(1) "A"
+    ["type"]=>
+    string(0) ""
+    ["tmp_name"]=>
+    string(%d) "%s"
+    ["error"]=>
+    int(0)
+    ["size"]=>
+    int(1)
+  }
+  ["B"]=>
+  array(5) {
+    ["name"]=>
+    string(1) "B"
+    ["type"]=>
+    string(0) ""
+    ["tmp_name"]=>
+    string(%d) "%s"
+    ["error"]=>
+    int(0)
+    ["size"]=>
+    int(1)
+  }
+  ["C"]=>
+  array(5) {
+    ["name"]=>
+    string(1) "C"
+    ["type"]=>
+    string(0) ""
+    ["tmp_name"]=>
+    string(%d) "%s"
+    ["error"]=>
+    int(0)
+    ["size"]=>
+    int(1)
+  }
+}
+ALERT - configured fileupload limit exceeded - file dropped (attacker 'REMOTE_ADDR not set', file '%s')
\ No newline at end of file
diff --git a/tests/filter/suhosin_upload_remove_binary.phpt b/tests/filter/suhosin_upload_remove_binary.phpt
new file mode 100644
index 0000000..8d158c3
--- /dev/null
+++ b/tests/filter/suhosin_upload_remove_binary.phpt
diff --git a/tests/filter/suhosin_upload_remove_binary_utf8.phpt b/tests/filter/suhosin_upload_remove_binary_utf8.phpt
new file mode 100644
index 0000000..564c095
--- /dev/null
+++ b/tests/filter/suhosin_upload_remove_binary_utf8.phpt
@@ -0,0 +1,34 @@
+--TEST--
+Testing: suhosin.upload.remove_binary=On with UTF-8
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.stdout=255
+suhosin.log.script=0
+file_uploads=1
+suhosin.upload.disallow_binary=Off
+suhosin.upload.remove_binary=On
+suhosin.upload.allow_utf8=On
+max_file_uploads=40
+suhosin.upload.max_uploads=40
+--SKIPIF--
+<?php include('../skipif.inc');
+if (ini_get('suhosin.upload.allow_utf8') === FALSE) { die("skip feature not compiled in"); }
+?>
+--COOKIE--
+--GET--
+--POST_RAW--
+Content-Type: multipart/form-data; boundary=bound
+--bound
+Content-Disposition: form-data; name="test"; filename="test"
+
+Spaß am Gerät!
+
+--bound--
+--FILE--
+<?php
+var_dump(file_get_contents($_FILES['test']['tmp_name']));
+?>
+--EXPECTF--
+string(17) "Spaß am Gerät!
+"
\ No newline at end of file
diff --git a/tests/filter/suhosin_upload_remove_binary_utf8fail.phpt b/tests/filter/suhosin_upload_remove_binary_utf8fail.phpt
new file mode 100644
index 0000000..4787a3a
--- /dev/null
+++ b/tests/filter/suhosin_upload_remove_binary_utf8fail.phpt
@@ -0,0 +1,34 @@
+--TEST--
+Testing: suhosin.upload.remove_binary=On with UTF-8 and allow_utf8=Off
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.stdout=255
+suhosin.log.script=0
+file_uploads=1
+suhosin.upload.disallow_binary=Off
+suhosin.upload.remove_binary=On
+suhosin.upload.allow_utf8=Off
+max_file_uploads=40
+suhosin.upload.max_uploads=40
+--SKIPIF--
+<?php include('../skipif.inc');
+if (ini_get('suhosin.upload.allow_utf8') === FALSE) { die("skip feature not compiled in"); }
+?>
+--COOKIE--
+--GET--
+--POST_RAW--
+Content-Type: multipart/form-data; boundary=bound
+--bound
+Content-Disposition: form-data; name="test"; filename="test"
+
+Spaß am Gerät!
+
+--bound--
+--FILE--
+<?php
+var_dump(file_get_contents($_FILES['test']['tmp_name']));
+?>
+--EXPECTF--
+string(13) "Spa am Gert!
+"
\ No newline at end of file
diff --git a/ufilter.c b/ufilter.c
new file mode 100644
index 0000000..cb36a67
--- /dev/null
+++ b/ufilter.c
@@ -0,0 +1,425 @@
+/*
+  +----------------------------------------------------------------------+
+  | Suhosin Version 1                                                    |
+  +----------------------------------------------------------------------+
+  | Copyright (c) 2006-2007 The Hardened-PHP Project                     |
+  | Copyright (c) 2007-2016 SektionEins GmbH                             |
+  +----------------------------------------------------------------------+
+  | This source file is subject to version 3.01 of the PHP license,      |
+  | that is bundled with this package in the file LICENSE, and is        |
+  | available through the world-wide-web at the following url:           |
+  | http://www.php.net/license/3_01.txt                                  |
+  | If you did not receive a copy of the PHP license and are unable to   |
+  | obtain it through the world-wide-web, please send a note to          |
+  | license@php.net so we can mail you a copy immediately.               |
+  +----------------------------------------------------------------------+
+  | Authors: Stefan Esser <sesser@sektioneins.de>                        |
+  |          Ben Fuhrmannek <ben.fuhrmannek@sektioneins.de>              |
+  +----------------------------------------------------------------------+
+*/
+/*
+  $Id: ufilter.c,v 1.1.1.1 2007-11-28 01:15:35 sesser Exp $ 
+*/
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "php.h"
+#include "php_ini.h"
+#include "ext/standard/info.h"
+#include "php_suhosin7.h"
+#include "php_variables.h"
+#include "suhosin_rfc1867.h"
+#include "ext/standard/php_var.h"
+
+// #if !HAVE_RFC1867_CALLBACK
+// PHP_SUHOSIN_API int (*php_rfc1867_callback)(unsigned int event, void *event_data, void **extra) = NULL;
+// #endif
+// 
+
+/* {{{ SAPI_UPLOAD_VARNAME_FILTER_FUNC
+ */
+static int check_fileupload_varname(char *varname)
+{
+        char *index, *prev_index = NULL, *var;
+        unsigned int var_len, total_len, depth = 0;
+
+        var = estrdup(varname);
+
+        /* Normalize the variable name */
+        suhosin_normalize_varname(var);
+        
+        /* Find length of variable name */
+        index = strchr(var, '[');
+        total_len = strlen(var);
+        var_len = index ? index-var : total_len;
+        
+        /* Drop this variable if it exceeds the varname/total length limit */
+        if (SUHOSIN7_G(max_varname_length) && SUHOSIN7_G(max_varname_length) < var_len) {
+                suhosin_log(S_FILES, "configured request variable name length limit exceeded - dropped variable '%s'", var);
+                if (!SUHOSIN7_G(simulation)) {
+                        goto return_failure;
+                }
+        }
+        if (SUHOSIN7_G(max_totalname_length) && SUHOSIN7_G(max_totalname_length) < total_len) {
+                suhosin_log(S_FILES, "configured request variable total name length limit exceeded - dropped variable '%s'", var);
+                if (!SUHOSIN7_G(simulation)) {
+                        goto return_failure;
+                }
+        }
+        if (SUHOSIN7_G(max_post_name_length) && SUHOSIN7_G(max_post_name_length) < var_len) {
+                suhosin_log(S_FILES, "configured POST variable name length limit exceeded - dropped variable '%s'", var);
+                if (!SUHOSIN7_G(simulation)) {
+                        goto return_failure;
+                }
+        }
+        if (SUHOSIN7_G(max_post_totalname_length) && SUHOSIN7_G(max_post_totalname_length) < var_len) {
+                suhosin_log(S_FILES, "configured POST variable total name length limit exceeded - dropped variable '%s'", var);
+                if (!SUHOSIN7_G(simulation)) {
+                        goto return_failure;
+                }
+        }
+        
+        /* Find out array depth */
+        while (index) {
+                char *index_end;
+                unsigned int index_length;
+                
+                /* overjump '[' */
+                index++;
+                
+                /* increase array depth */
+                depth++;
+                                
+                index_end = strchr(index, ']');
+                if (index_end == NULL) {
+                        index_end = index+strlen(index);
+                }
+                
+                index_length = index_end - index;
+                        
+                if (SUHOSIN7_G(max_array_index_length) && SUHOSIN7_G(max_array_index_length) < index_length) {
+                        suhosin_log(S_FILES, "configured request variable array index length limit exceeded - dropped variable '%s'", var);
+                        if (!SUHOSIN7_G(simulation)) {
+                                goto return_failure;
+                        }
+                } 
+                if (SUHOSIN7_G(max_post_array_index_length) && SUHOSIN7_G(max_post_array_index_length) < index_length) {
+                        suhosin_log(S_FILES, "configured POST variable array index length limit exceeded - dropped variable '%s'", var);
+                        if (!SUHOSIN7_G(simulation)) {
+                                goto return_failure;
+                        }
+                } 
+                
+                /* index whitelist/blacklist */
+                if (SUHOSIN7_G(array_index_whitelist) && *(SUHOSIN7_G(array_index_whitelist))) {
+                        if (suhosin_strnspn(index, index_length, SUHOSIN7_G(array_index_whitelist)) != index_length) {
+                                suhosin_log(S_VARS, "array index contains not whitelisted characters - dropped variable '%s'", var);
+                                if (!SUHOSIN7_G(simulation)) {
+                                        goto return_failure;
+                                }
+                        }
+                } else if (SUHOSIN7_G(array_index_blacklist) && *(SUHOSIN7_G(array_index_blacklist))) {
+                        if (suhosin_strncspn(index, index_length, SUHOSIN7_G(array_index_blacklist)) != index_length) {
+                                suhosin_log(S_VARS, "array index contains blacklisted characters - dropped variable '%s'", var);
+                                if (!SUHOSIN7_G(simulation)) {
+                                        goto return_failure;
+                                }
+                        }
+                }
+                
+                
+                index = strchr(index, '[');             
+        }
+        
+        /* Drop this variable if it exceeds the array depth limit */
+        if (SUHOSIN7_G(max_array_depth) && SUHOSIN7_G(max_array_depth) < depth) {
+                suhosin_log(S_FILES, "configured request variable array depth limit exceeded - dropped variable '%s'", var);
+                if (!SUHOSIN7_G(simulation)) {
+                        goto return_failure;
+                }
+        }
+        if (SUHOSIN7_G(max_post_array_depth) && SUHOSIN7_G(max_post_array_depth) < depth) {
+                suhosin_log(S_FILES, "configured POST variable array depth limit exceeded - dropped variable '%s'", var);
+                if (!SUHOSIN7_G(simulation)) {
+                        goto return_failure;
+                }
+        }
+        
+        
+        /* Drop this variable if it is one of GLOBALS, _GET, _POST, ... */
+        /* This is to protect several silly scripts that do globalizing themself */
+        if (suhosin_is_protected_varname(var, var_len)) {
+                suhosin_log(S_FILES, "tried to register forbidden variable '%s' through FILE variables", var);
+                if (!SUHOSIN7_G(simulation)) {
+                        goto return_failure;
+                }
+        }
+
+        efree(var);
+        return SUCCESS;
+        
+return_failure:
+        efree(var);
+        return FAILURE; 
+}
+/* }}} */
+
+#ifdef SUHOSIN7_EXPERIMENTAL
+static inline int suhosin_validate_utf8_multibyte(const char* cp, size_t maxlen)
+{
+        if (maxlen < 2 || !(*cp & 0x80)) { return 0; }
+        if ((*cp & 0xe0) == 0xc0 &&                                     // 1st byte is 110xxxxx
+                (*(cp+1) & 0xc0) == 0x80 &&                             // 2nd byte is 10xxxxxx
+                (*cp & 0x1e)) {                                                 // overlong check 110[xxxx]x 10xxxxxx
+                         return 2;
+        }
+        if (maxlen < 3) { return 0; }
+        if ((*cp & 0xf0) == 0xe0 &&                                     // 1st byte is 1110xxxx
+                (*(cp+1) & 0xc0) == 0x80 &&                             // 2nd byte is 10xxxxxx
+                (*(cp+2) & 0xc0) == 0x80 &&                             // 3rd byte is 10xxxxxx
+                ((*cp & 0x0f) | (*(cp+1) & 0x20))) {    // 1110[xxxx] 10[x]xxxxx 10xxxxxx
+                        return 3;
+        }
+        if (maxlen < 4) { return 0; }
+        if ((*cp & 0xf8) == 0xf0 &&                             // 1st byte is 11110xxx
+                (*(cp+1) & 0xc0) == 0x80 &&                             // 2nd byte is 10xxxxxx
+                (*(cp+2) & 0xc0) == 0x80 &&                             // 3rd byte is 10xxxxxx
+                (*(cp+3) & 0xc0) == 0x80 &&                             // 4th byte is 10xxxxxx
+                ((*cp & 0x07) | (*(cp+1) & 0x30))) {    // 11110[xxx] 10[xx]xxxx 10xxxxxx 10xxxxxx
+                        return 4;
+        }
+        return 0;
+}
+#endif
+
+int suhosin_rfc1867_filter(unsigned int event, void *event_data, void **extra)
+{
+        int retval = SUCCESS;
+
+        SDEBUG("rfc1867_filter %u", event);
+
+        switch (event) {
+                case MULTIPART_EVENT_START:
+                case MULTIPART_EVENT_FORMDATA:
+                        /* nothing todo */
+                        break;
+
+                case MULTIPART_EVENT_FILE_START:
+                        {
+                                multipart_event_file_start *mefs = (multipart_event_file_start *) event_data;
+                                
+                                /* Drop if no more variables flag is set */
+                                if (SUHOSIN7_G(no_more_uploads)) {
+                                        goto continue_with_failure;
+                                }
+
+                                /* Drop this fileupload if the limit is reached */
+                                if (SUHOSIN7_G(upload_limit) && SUHOSIN7_G(upload_limit) <= SUHOSIN7_G(num_uploads)) {
+                                        suhosin_log(S_FILES, "configured fileupload limit exceeded - file dropped");
+                                        if (!SUHOSIN7_G(simulation)) {
+                                                SUHOSIN7_G(no_more_uploads) = 1;
+                                                goto continue_with_failure;
+                                        }
+                                }
+
+                                if (check_fileupload_varname(mefs->name) == FAILURE) {
+                                        goto continue_with_failure;
+                                }
+                        }
+
+                        break;
+
+                case MULTIPART_EVENT_FILE_DATA:
+
+                        if (SUHOSIN7_G(upload_disallow_elf)) {
+                                multipart_event_file_data *mefd = (multipart_event_file_data *) event_data;
+
+                                if (mefd->offset == 0 && mefd->length > 10) {
+                                        if (mefd->data[0] == 0x7F && mefd->data[1] == 'E' && mefd->data[2] == 'L' && mefd->data[3] == 'F') {
+                                                suhosin_log(S_FILES, "uploaded file is an ELF executable - file dropped");
+                                                if (!SUHOSIN7_G(simulation)) {
+                                                        goto continue_with_failure;
+                                                }
+                                        }
+                                }
+                        }
+
+                        if (SUHOSIN7_G(upload_disallow_binary)) {
+                        
+                                multipart_event_file_data *mefd = (multipart_event_file_data *) event_data;
+
+                                char *cp, *cpend;
+                                int n;
+                                cpend = mefd->data + mefd->length;
+                                for (cp = mefd->data; cp < cpend; cp++) {
+                                        if (*cp >= 32 || isspace(*cp)) {
+                                                continue;
+                                        }
+#ifdef SUHOSIN7_EXPERIMENTAL
+                                        if ((*cp & 0x80) && SUHOSIN7_G(upload_allow_utf8)) {
+                                                SDEBUG("checking char %x", *cp);
+                                                if ((n = suhosin_validate_utf8_multibyte(cp, cpend-cp))) { // valid UTF8 multibyte character
+                                                        cp += n - 1;
+                                                        continue;
+                                                }
+                                        }
+#endif
+                                        suhosin_log(S_FILES, "uploaded file contains binary data - file dropped");
+                                        if (!SUHOSIN7_G(simulation)) {
+                                                goto continue_with_failure;
+                                        }
+                                        break;
+                                }
+                        }
+
+                        if (SUHOSIN7_G(upload_remove_binary)) {
+                        
+                                multipart_event_file_data *mefd = (multipart_event_file_data *) event_data;
+                                size_t i, j;
+                                int n;
+                                
+                                for (i=0, j=0; i<mefd->length; i++) {
+                                        if (mefd->data[i] >= 32 || isspace(mefd->data[i])) {
+                                                mefd->data[j++] = mefd->data[i];
+                                        }
+#ifdef SUHOSIN7_EXPERIMENTAL
+                                        else if (SUHOSIN7_G(upload_allow_utf8) && mefd->data[i] & 0x80) {
+                                                n = suhosin_validate_utf8_multibyte(mefd->data + i, mefd->length - i);
+                                                if (!n) { continue; }
+                                                while (n--) {
+                                                        mefd->data[j++] = mefd->data[i++];
+                                                }
+                                                i--;
+                                        }
+#endif
+                                }
+                                mefd->data[j] = '\0';
+                                
+                                SDEBUG("removing binary %zu %zu",i,j);
+                                /* IMPORTANT FOR DAISY CHAINING */
+                                mefd->length = j;
+                                if (mefd->newlength) {
+                                        *mefd->newlength = j;
+                                }
+                        }
+                        
+                        break;
+
+                case MULTIPART_EVENT_FILE_END:
+                        
+                        if (SUHOSIN7_G(upload_verification_script)) {
+                                multipart_event_file_end *mefe = (multipart_event_file_end *) event_data;
+                                char cmd[8192];
+                                FILE *in;
+                                int first=1;
+                                struct stat st;
+                                char *sname = SUHOSIN7_G(upload_verification_script);
+                                
+                                /* ignore files that will get deleted anyway */
+                                if (mefe->cancel_upload) {
+                                        break;
+                                }
+                                
+                                /* ignore empty scriptnames */
+                                while (isspace(*sname)) ++sname;
+                                if (*sname == 0) {
+                                        SUHOSIN7_G(num_uploads)++;
+                                        break;
+                                }
+                                
+                                if (VCWD_STAT(sname, &st) < 0) {
+                                        suhosin_log(S_FILES, "unable to find fileupload verification script %s - file dropped", sname);
+                                        if (!SUHOSIN7_G(simulation)) {
+                                                goto continue_with_failure;
+                                        } else {
+                                                goto continue_with_next;
+                                        }
+                                }
+                                if (access(sname, X_OK|R_OK) < 0) {
+                                        suhosin_log(S_FILES, "fileupload verification script %s is not executable - file dropped", sname);
+                                        if (!SUHOSIN7_G(simulation)) {
+                                                goto continue_with_failure;
+                                        } else {
+                                                goto continue_with_next;
+                                        }
+                                }
+                                
+                                ap_php_snprintf(cmd, sizeof(cmd), "%s %s 2>&1", sname, mefe->temp_filename);
+
+                                if ((in = VCWD_POPEN(cmd, "r")) == NULL) {
+                                        suhosin_log(S_FILES, "unable to execute fileupload verification script %s - file dropped", sname);
+                                        if (!SUHOSIN7_G(simulation)) {
+                                                goto continue_with_failure;
+                                        } else {
+                                                goto continue_with_next;
+                                        }
+                                }
+                
+                                retval = FAILURE;
+                
+                                /* read and forget the result */
+                                while (1) {
+                                        int readbytes = fread(cmd, 1, sizeof(cmd), in);
+                                        if (readbytes<=0) {
+                                                break;
+                                        }
+                                        if (first) {
+                                                if (strncmp(cmd, "sh: ", 4) == 0) {
+                                                        /* assume this is an error */
+                                                        suhosin_log(S_FILES, "error while executing fileupload verification script %s - file dropped", sname);
+                                                        if (!SUHOSIN7_G(simulation)) {
+                                                                goto continue_with_failure;
+                                                        } else {
+                                                                goto continue_with_next;
+                                                        }
+                                                } else {
+                                                        retval = atoi(cmd) == 1 ? SUCCESS : FAILURE;
+                                                        first = 0;
+                                                }
+                                        }
+                                }
+                                pclose(in);
+                        }
+
+                        if (retval != SUCCESS) {
+                                suhosin_log(S_FILES, "fileupload verification script disallows file - file dropped");
+                                if (!SUHOSIN7_G(simulation)) {
+                                        goto continue_with_failure;
+                                }
+                        }
+
+                        SUHOSIN7_G(num_uploads)++;
+                        break;
+
+                case MULTIPART_EVENT_END:
+                        /* nothing todo */
+                        break;
+                        
+                default:
+                        /* unknown: return failure */
+                        goto continue_with_failure;
+        }
+continue_with_next:     
+// #if HAVE_RFC1867_CALLBACK
+        if (php_rfc1867_callback != NULL) {
+                return php_rfc1867_callback(event, event_data, extra);
+        }
+// #endif
+        return SUCCESS;
+continue_with_failure:
+        SUHOSIN7_G(abort_request) = 1;  
+        return FAILURE;
+}
+
+
+
+/*
+ * Local variables:
+ * tab-width: 4
+ * c-basic-offset: 4
+ * End:
+ * vim600: sw=4 ts=4 fdm=marker
+ * vim<600: sw=4 ts=4
+ */