centos - PHP Warning: Unknown: Input variables exceeded 1000

Question

I am getting a new php warning when a POST data from a form on my page to my server. The warning is as follows:

PHP Warning: Unknown: Input variables exceeded 1000. To increase the limit change max_input_vars in php.ini. in Unknown on line 0, referer: https://mywebsite.com/index.php

The thing is that my form does not have near 1000 input variables, so I am baffled as to why this is appearing. As a side note, I have not had this problem until recently and I suspect that when I ran yum update something changed/was installed that is causing this. Any advice or answers are appreciated.

EDIT 1: So I did var_dump($_REQUEST) and got ~1000 single character strings. The first couple items in the array are what they should be, but then a bunch of stuff that I don't need submitted is broken down into single character strings. Thoughts welcome.

array(1001) { 
    ["action"]=> string(10) "step1_show" 
    ["submit"]=> string(6) "Step 1" 
    [0]=> string(1) "a" 
    [1]=> string(1) "c" 
    [2]=> string(1) "t" 
    [3]=> string(1) "i" 
    [4]=> string(1) "o" 
    [5]=> string(1) "n" 
    [6]=> string(1) "=" 
    [7]=> string(1) "l" 
    [8]=> string(1) "o" 
    [9]=> string(1) "g" 
    [10]=> string(1) "o" 
    [11]=> string(1) "u" 
    [12]=> string(1) "t" 
    [13]=> string(1) "&" 
    [14]=> string(1) "p" 
    [15]=> string(1) "r" 
    [16]=> string(1) "o" 
    [17]=> string(1) "p" 
    [18]=> string(1) "e" 
    [19]=> string(1) "r" 
    [20]=> string(1) "t" 
    [21]=> string(1) "y" 
    [22]=> string(1) "=" 
    [23]=> string(1) "3" 
    [24]=> string(1) "7" 
    [25]=> .....     

ANSWER: It ended up being a problem with my submit handler. Thanks all for your input.

Answer 1

That's a new setting / value in PHP (related to a security update to prevent attacks to PHP scripts), so you get this after the update (before PHP 5.3.9 not set/available, suhosin users have a similar thing since ages).

Input values are of different kinds and array members count as well. So it's not enough to count form fields but also to take a look into the URL and other places related to input ($_GET, $_POST, $_SERVER, $_ENV, $_FILES, $_COOKIE ...).

See max_input_vars:

How many input variables may be accepted. Use of this directive mitigates the possibility of denial of service attacks which use hash collisions. If there are more input variables than specified by this directive, an E_WARNING is issued, and further input variables are truncated from the request. This limit applies only to each nesting level of a multi-dimensional input array.