That code should be fine... I built a shopping cart to download files a while back and have included some code I used to send the file out. I update a database field to limit the number of times the file is able to be downloaded. The example here uses a PDF file, but your Header calls look fine:
<?php
function push_file($file) {
header("Content-Type: application/pdf");
if (strstr($HTTP_USER_AGENT,"MSIE")) $attachment="";
else $attachment=" attachment;";
header("Content-Disposition:$attachment filename=\"$file\"");
header("Content-Transfer-Encoding: binary");
$fn=fopen("/home/chauvinistguide/files/$file" , "r");
fpassthru($fn);
}
/ Include the Database Connection and Functions /
Include('connect.php');
connect();
/ Update the number of attempts in the database /
$sql = "UPDATE purchases_emails set attempts = '$num_attempts' where sesid='$sesid' and email='$email' AND pid='$pid'";
$result = @($sql);
/ Now push the file /
$result = @("SELECT filename from products where pid = '$pid'");
$file = @mysql_result($result, 0);
push_file($file);
?>
John Cornett