This is just kicking my butt too. It's so incredibly frustrating.
I'm trying to make a semi-secure download script; The user clicks their file, and it gets fed to them via HTTP. There is no direct URL to the file it's self, they have to be "logged in".
All of the browsers seem to do it differently. Some support Content-Disposition, some don't (it's not a standard, so you get what you pay for I guess). I can get Netscape 4.x and IE 5.x to work, but Netscape 6 makes a mess of it.. if you go by the direct URL method, this works in NS6, but if you URL-encode the filename if it contains spaces, the user winds up getting a filename with the encoding in it (Some%20File%20Name.txt) whereas NS 4.7x will decode the name properly first.
Argh! There has to be some happy medium to make it do what you want all the time, short of having to look at the headers from the browser, figure out what kind it is, and then customize the download process for them. I'm not a huge web guy and not up on the RFCs, but is some sort of standard being worked on for the next version of HTTP??
Personal Opinion: Netscape 6 is trash, but unfortunately there are people out there who are going to download it and use it not knowing any better, so I can't just pretend it doesn't exist.