Download issues, not sure why?

darthmahon

Hey,

Ok using the following to force downloads:

<?
// open session for user
session_save_path('/home/accessdata');
session_cache_limiter('private, must-revalidate');
session_start();
session_write_close();

// include db information file
include("access/data.inc.php");

$id = $_REQUEST['id'];

mysql_connect ($SQLhost, $SQLuser, $SQLpass);

mysql_select_db ($SQLdb);

$select = mysql_query ("SELECT filename FROM FILES WHERE fileid=$id" );
$result = mysql_query($select) or die ("Error in query: $select. " .

mysql_error());

$row = mysql_fetch_object($result);

$filename = $row['filename'];
$file_size = filesize($filename);
$fp = fopen($filename, 'rb');

header("Content-Length: $file_size");
header("Content-transfer-encoding: binary");
header("Content-Type: application/pdf");
header("Content-Disposition: inline; filename=\"" . $filename ."\"");
header('Expires: 0');

$content = fread($fp, $file_size);
fclose($fp);
print $content;
exit; 

?>

Now I'm getting the following error:

Error in query: Resource id #2. You have an error in your SQL syntax near 'Resource id #2' at line 1

Any ideas on why this isn't downloading?

Cheers,
Chris

goldbug

Are you sure it's returning rows (the sql query)?

You check to see if it (the query) fails, but never check to see if any rows are returned.

EDIT:
Also, you aren't checking if $id actually has a value, and you aren't cleaning it. If it has no value, the query will fail. Without cleaning, it's trivial to send a request with a SQL injection attack and possibly do some damage to your database.

darthmahon

Hey,

Sorted the first bit out, had some problems with brackets in the query.

Now I have a new problem, it seems to not like how I am putting the filename together:

$row = mysql_fetch_object($result);

	$filename = $row['filename'];
	$file_size = filesize($filename);
	$root_path = "/home/filelibrary/"; 
	$myfile = $root_path . $filename; 
	$fp = fopen($myfile, 'rb');

	header("Content-Length: $file_size");
	header("Content-transfer-encoding: binary");
	header("Content-Type: application/pdf");
	header("Content-Disposition: inline; filename=\"" . $filename ."\"");
	header('Expires: 0');

	$content = fread($fp, $file_size);
	fclose($fp);
	print $content;
	exit;

I'm getting errors like so:

Warning: stat failed for (errno=2 - No such file or directory) in /home/nbooth/public_html/beta/download.php on line 31 Warning: Cannot add header information - headers already sent by (output started at /home/nbooth/public_html/beta/download.php:31) in /home/nbooth/public_html/beta/download.php on line 36 Warning: Cannot add header information - headers already sent by (output started at /home/nbooth/public_html/beta/download.php:31) in /home/nbooth/public_html/beta/download.php on line 37 Warning: Cannot add header information - headers already sent by (output started at /home/nbooth/public_html/beta/download.php:31) in /home/nbooth/public_html/beta/download.php on line 38 Warning: Cannot add header information - headers already sent by (output started at /home/nbooth/public_html/beta/download.php:31) in /home/nbooth/public_html/beta/download.php on line 39 Warning: Cannot add header information - headers already sent by (output started at /home/nbooth/public_html/beta/download.php:31) in /home/nbooth/public_html/beta/download.php on line 40

goldbug

Try checking to see if the file exists and is readable first. It could be just a permissions issue (no read access for the apache/server user)