file downloads and header()

Anon

I'm am trying to create a link to a file and have php hide the file location but I'm having some problems.

Here's the code:

$filetype = filetype("$FILE_ROOT/$filename");
$filesize = filesize("$FILE_ROOT/$filename");

header("Content-type: $filetype");
header("Content-length: $filesize");
header("Content-Disposition: filename=$filename");

readfile("$FILE_ROOT/$filename");

It works great for file types the browser doesn't support but when I try to send files that the browser does support (images, html, etc) rather than just open the file it prompts the user asking them what they wish to do (open or save). Removing the 3 header calls solves the problem for the supported files but then unsupported files are output as text (very ugly way to d/l a binary.) I'd like to figure out a way to get the best of both worlds. Any ideas?

By the way if anyone knows a link to a site with a tutorial on what values can/should go in HTML headers and what the heck each value means please let me know.

Thanks

Anon

If you want to force a file to be downloaded, and prevent the
browser from popping up the what-to-do message box, set the type
to "application/octet-stream" (hmm, better check about capitalization
there.) You can still supply the suggested filename bearing the
extension you want that will help the end-user (and the system,
if it be Windows) understand what type of file it actually is.

Anon

To get the right filename into the "Save As.." dialog you will need to make that file the actual path. Otherwise your users will get "sendfile.php" or whatever as the file name in the "Save As..." box. Try the script below, it works perfect for me.

<?
$filepath = $PATH_INFO;
$filename = basename($filepath);

Header("Content-Disposition: attachment; filename=\"$filename\"");
Header("Content-Type: application/octet-stream");
readfile($FILE_ROOT."/".$filename);
?>

You would to get to this file you have a url like this:

http://your_server.com/sendfile.php/thefile.doc

Anon

Your code sample works great but it forces the "Save As.." dialogue to pop up in IE 5.5 under all circumstances even if the browser knows how to display a file. It also displays the name of the php file ("download.php") rather than the name of the file itself.

What I am try to do is allow users with different access levels access to different files. So say there are two access levels - user and admin.

Users with user access will have access to the "c:\user" dir and users with admin access will have access to the "c:\admin" dir.

While downloading the file I'm trying to accomplish a few things:

1) I want to hide the actual location of the file ("c:\user" or "c:\admin") so the user has no idea where the file is being stored on the server. NOTE: The file will not be stored in htdocs dir or a sub dir of for the same reason php inc files are not included there.

2) Files that the browsers recognizes should be dealt with appropriately (jpegs, gifs, etc.) and other files should prompt the user with an option box asking them how to deal with the file (ie. "Save As.." or "Open With..")

3) When the "Save As.." option appears the filename of the file to be saved is correct sans path rather than say download.php. So rather than "You have chosen to download... download.php from localhost" I would like to display "You have chosen to download... "filename.ext" from localhost"
where "filename.ext" is the correct filename.

I'm really stumped here. I've tried countless combinitions acheiving each goal individually but never acheiving all at the same time.

Thanks,
Brian

Anon

You will have to do some validation to see if it is one that the browser supports. For example:

$filetype = filetype("$FILE_ROOT/$filename");

switch($filetype)
{
  case "text/html":
     // the broswer knows how to handle this so no headers
     readfile("$FILE_ROOT/$filename");
     break;
  case "image/gif":
    readfile("$FILE_ROOT/$filename");
    break;
  default:
    header("Content-Disposition: attachment; filename=\"$filename\"");
    header("Content-Type: application/octet-stream");
    readfile($FILE_ROOT."/".$filename);
}

If you are getting the filename "download.php" in your Save As... box it is because you are not using the right url.

If you use http://your_server.com/download.php?filename=myfile.ext you will get "download.php" in the save as box.

If you use http://your_server.com/download.php/myfile.ext your Save As... box will say "yourfile.ext"

Jack