Making file available for download.

[Love2c0de]

Hello, I am creating a site which let's users download gaming demo files such as CS, CS:CZ. I need some guidance on the download.php file. I need help with retrieving the actual file contents.

 

Here is my code:

<?php
$file = $_GET['id'];
$name = $_GET['name'];

require("connect.php");

$qry = mysql_query("SELECT name FROM demos WHERE id=$file");
$row = mysql_fetch_array($qry);

if(file_exists("files/{$row['name']}")){
     
  header("Content-type: application/octet-stream");
  header("Content-Disposition: attachment; filename=$name");
  
}
else{
     echo "File does not exist.";
}
?>

 

This is bringing up the download save/open box, but the file is empty. (0kb).

 

I have read about fread() etc but I cannot understand how to do it.

 

I was looking for some guidance and help on achieving this.

 

Kind Regards,

 

BuNgLe.

[scootstah]

You're on the right track, but you need to output the contents of the file to the browser.

 

So after the two header() calls, use readfile to output the file.

 

header("Content-type: application/octet-stream");
header("Content-Disposition: attachment; filename=$name");

readfile('files/' . $row['name']);

[Love2c0de]

Thank you very much for your reply. I added the line of code you suggested and it works perfectly now.

 

I know I have to validate the input values for injections etc but is there anything else you would secure better looking at my code?

 

Regards,

 

BuNgLe

[scootstah]

You may be susceptible to Local File Inclusion.

[Love2c0de]

Looking at that code and my code it should go in the download.php file when I GET the id and name of the file. Is that correct?

 

Thanks for the reply.

 

Regards,

 

BuNgLe

 

 

[scootstah]

What code should go in your download.php file?

 

You should be urldecoding and stripping slashes from the $_GET input.

[Love2c0de]

The code from the link:

 
$file = str_replace('../', '', $_GET['file']);
   if(isset($file))
   {
       include("pages/$file");
   }
   else
   {
       include("index.php");
   }

 

my download.php page looks like this now:

 
<?php
$file = $_GET['id'];
$name = $_GET['name'];
require("connect.php");
$qry = mysql_query("SELECT name FROM demos WHERE id=$file");
$row = mysql_fetch_array($qry);
if(file_exists("files/$name")){
     
  header("Content-type: application/octet-stream");  
  header("Content-Disposition: attachment; filename=$name");  
  
  readfile('files/' . $row['name']);
}
else{
     echo "File does not exist.";
}
?>

 

Should I put the website example code at the top of my download.php file before I start connecting to the db and selecting files and all the other stuff?

 

Regarding the urlencoding, would I do that when I display the actual links? For example my code which I have to display the links:

 

while($row = mysql_fetch_array($qry)){
             echo "<a href='download.php?id={$row['id']}&name={$row['name']}'>{$row['name']}</a>" . " " . $row['description'] . " " . $row['date'];
             echo "<br />";
         }

 

Would I encode that anchor url? The website doesn't really go into much depth about it and I've searched google but all the examples that come up are really not related directly to my issue.

 

Thanks for your time.

 

Regards,

 

BuNgLe