DL file via header()

[Kudose]

Here is the mission. To retrieve info from the DB, create a link, DL the file via the link on a different page via header(). It works...kinda. Except it tries to DL a file I have never heard of that isnt even on my server.

Here is my link script:

---

include('dbinfo.inc.php'); 
include('css.php'); 
$query = mysql_query("SELECT * FROM scripts WHERE type='gnu'") or die(mysql_error()); 
$num = mysql_num_rows($query) or die(mysql_error()); 
for($i=0; $i<$num; $i++){ 
$fetch = mysql_fetch_array($query) or die(mysql_error()); 
$name = $fetch['name']; 
$descrip = $fetch['descrip']; 
$downloads = $fetch['downloads']; 
$mysql = $fetch['mysql']; 
$type = $fetch['type']; 
$filename = $fetch['filename']; 
$cat = $fetch['cat']; 
$id = $fetch['id']; 
echo "<br> <b><a href='download.php?file=$id' target='_blank'>$name </a></b>.::. <b>Category:</b> $cat .::. <b>MySQL Needed:</b> $mysql .::. <b>Downloads:</b> $downloads <br> <b>Description:</b> $descrip <br><br>"; 
}

--------------------------------------------------------------------------------

Here is my download.php page

---

<?  

include('dbinfo.inc.php'); 
$id = $HTTP_GET_VARS['file'];  

$filename = mysql_query("SELECT filename FROM scripts WHERE id='$id'") or die(mysql_error());  

mysql_query("UPDATE scripts SET downloads=downloads+1 WHERE id='$id'") or die(mysql_error());  

header("Content-Disposition: attachment; Content-Type: application/octet-stream; filename='scripts/$filename'");  

?>  

--------------------------------------------------------------------------------

THANKS!

[drew010]

with the sql queries in the download.php script. you arent quite done getting variables.

mysql_query() returns a resource, not actually what you tried to query for, so the line

$filename = mysql_query("SELECT filename FROM scripts WHERE id='$id'") or die(mysql_error());

isnt going to get you exactly what you want. $filename will contain the resource id of the sql link. not the filename.

you will need to do

$result = mysql_query("SELECT filename FROM scripts WHERE id='$id'") or die(mysql_error());
$filename1 = mysql_fetch_row($result);
$filename = $filename1[0];

also, you will want to modify your header() call to be something like this:

<?
//...
header("Content-type: application/octet-stream"); //prompt for download
header("Content-disposition: attachment; filename=$filename"); //specify the filename to show
readfile("scripts/$filename"); //output the data of the file
exit;
?>

[Kudose]

Thanks, but that didnt work.

<? 
include('dbinfo.inc.php');
$id = $HTTP_GET_VARS['file']; 
$result = mysql_query("SELECT filename FROM scripts WHERE id='$id'") or die(mysql_error()); 
$filename1 = mysql_fetch_row($result); 
$filename = $filename1['filename']; 
mysql_query("UPDATE scripts SET downloads=downloads+1 WHERE id='$id'") or die(mysql_error()); 
header("Content-type: application/octet-stream"); //prompt for download 
header("Content-disposition: attachment; filename=$filename"); //specify the filename to show 
readfile("scripts/$filename"); //output the data of the file 
exit; 
?>

It asks me to DL a file, entitled download.php...which is the page it is on, which I dont want it to DL. But when I DL it, it is blank.

[Kudose]

Also, when I echo the $filename it is looking for the correct file, but it doesnt DL it.

[drew010]

here's something i made a while back, that works, i just tested it again. its a little different as far as retrieving from the database but if you play with it you should be able to modify it so it will work for you. i actually stored the binary file data in the database so echo'ing it was easy

<?
$postid = $_GET['postid'];
if(!isset($postid)) {
  echo "No file ID specified";
  exit;
}
include("./config.inc.php");
dbconnect();

$query = "SELECT * FROM ${dbpref}dump WHERE postid = '$postid'";
$result = mysql_query($query);
$data = mysql_fetch_object($result);
if(!$result) {
echo mysql_error();
}
if(!isset($_COOKIE['download_' . $postid])) {
  $cupdate = "UPDATE ${dbpref}dlcount SET count = count + 1 WHERE postid='$postid'";
  $cupres = @mysql_query($cupdate);
  $value = "downloaded";
  @setcookie("download_" . $postid,$value,time()[phone]);
}

header("Content-type: application/octet-stream");
header("Content-disposition: attachment; filename=$data->filename");
header("Content-Length: " . strlen($data->filedata));
echo $data->filedata;
exit;
?>