You should use CGI.pm, and that has a MAX_UPLOAD setting you can use. That would be the maximum for each upload, not a calculated total.

I don't think you're going to get timeouts with files of the size you mentioned. The security risk is if some bad person uploads a 10GB file, over and over again until your HD is so full that nothing can run. So a maximum of some kind is probably a good idea.