Upload files of all types in MySQL

[elavd]

Hello everybody! This is my first post in the forum...
I have a (possibly silly-newbie) question: I've created a site where the users must login in order to see a "secret" download page. The problem is that I don't want to just present some static links for the files that I want to give to my users. So I thought that I could store this files (most of them are in rar or zip format) in a MySQL DB in order to produce some dynamic links for the downloads and force someone to login first so as to see these links.
I made a script that does that, but I cannot store files of all types in my DB. I uploaded successfully some .doc, .jpg but I couldn't upload a .rar or an .mp3 although I have set in my php.ini
upload_max_filesize = 32M
Does anybody has an idea, what might I do wrong?
Thanks in advance!

[AstroTeg]

Easy... Don't store the file content in the database. Its not designed for this. But you know what is? The file system!

How do you make it all secure? Easy.

You have your site. It has a root folder. Its probably not the root folder of the server itself. You should be able to go up 1 directory. As you notice, no files are served from the 1 directory above root. There's physically no way - unless you have shell access and an account on that machine (not much of a security risk here since your MySQL data would be at risk as well).

So you go up one directory, create a directory to store all your files and make sure you set the permissions (read/write).

For your upload script, you do exactly what you're doing, but store the file in your upload directory which is 1 directory above your website's root. Notice that immediately after the upload, the user that uploaded can't even access the file. You'll probaby want to store the file properties in a table somewhere (like file name, permissions, etc).

To access the file, create a download script which does 2 things:

1. Authenticate the user - make sure the user requesting the file is allowed to access said file. Using a database here will help greatly.

2. Once authenticated, have PHP open the requested file in the directory the user can't get to and read the file and output it to the browser (remembering to send the proper headers).

Why not use the database? Databases are designed for data, not chunks of binary stuff. You have no need to search for a bit of binary data. You also balloon your database size possibly making problems for backups and restores. You'll kill the performance of your queries when it has to pull out all that data all the time.

[elavd]

2. Once authenticated, have PHP open the requested file in the directory the user can't get to and read the file and output it to the browser (remembering to send the proper headers).

AstroTeg, thanks a lot for your suggestion 🙂 Indeed, the DB backup would be a great problem with all this data stored in it!
Can you suggest me some links or tutorials in order to do this second thing that should the PHP script do?

[AstroTeg]

For #2, I don't have any tutorials that I know of. But its really pretty easy - even easier than working with a database, if you ask me.

First, do your authentication:
- make sure the user has access to the file
- make sure the user is requesting a file that exists (check that there's a record of the file in the database and if you want your app bullet proof, do a [man]file_exists[/man])

After authentication, figure out what content headers you need to send.

It might look something like this:

header('Content-type: application/vnd.ms-excel'));
			header('Content-Disposition: attachment; filename="filename.xls"');

Trick is you'll have to determine it from the file or save it as a field in your database.

Send the header out. Then its a matter of reading the file in and dumping it out to the user. That's pretty easy and there's a few ways to do it. One is with [man]fopen[/man] and a while loop. The other is [man]readfile[/man] which might be perfect for what you're doing.

And that's really about it. You'll want this to be a seperate PHP file. For the download link, you just point the user to your PHP file and it does the rest (if its working, you should see a download dialog box popup and ask you what you wish to do with the file download that's about to start).

[elavd]

And one last question before giving it a try... As you said it isn't wise to store the files in my DB. How can i dynamicaly recognize and send the correct Content-Type to the header(). Should I create a table in my DB with some fields such as filename, type, size, location.. etc?

[AstroTeg]

You can store the content type in the DB along with the file info. Or you could get creative and keep a list of file extensions and their associated content types in a table. Then when you feed a file out, you just check the extension and retrieve the proper content type. Its up to you...

[elavd]

Thanks AstroTeg. I'll try it 😉