Escaping characters in strings

mcmcom

Hi all,
I am totally new to PHP but have been writing software for many years. I need a bit of help.

I got this code to force download of files.:


<?
$filename = $_GET['file'];
if(!$filename){ echo "ERROR: No filename specified. Please try again."; }
else {

// fix for IE catching or PHP bug issue
header("Pragma: public");
header("Expires: 0"); // set expiration time
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
// browser must download file from server instead of cache

// force download dialog
header("Content-Type: application/force-download");
header("Content-Type: application/octet-stream");
header("Content-Type: application/download");

// use the Content-Disposition header to supply a recommended filename and
// force the browser to display the save dialog.
header("Content-Disposition: attachment; filename=".basename($filename).";");

header("Content-Transfer-Encoding: binary");


$myfile = $filename;

//header('Content-Length: '.filesize($myfile));

readfile('$myfile');
exit();
//must close after done
}

?>

Problem is that it just takes $filename as a variable. The file names can have spaces, commas, underscores, or dashes in them and when i pass the string if it contains any of those special characters (except the -, which seems to work) the file cannot be found. IE I have a file Called Text+This+Now.pdf when i pass that string from a calling app to this script, the script returns
Text This Now.pdf Which is clearly not the correct name. I was wondering if there was a regex pattern i could match this to, and if so, how do i implement it?

THANKS IN ADVANCE
MCM

rehfeld

the problem is because you are passing the file name through the url.

certain characters have special meanings when in a url

is one of them(it means a space)

these special characters are being decoded either by php or the browser

instead making your urls like this

script.php?file=foo+bar+baz.pdf

script.php?<?php echo urlencode('foo+bar+baz.pdf'); ?>

that should solve your problem

also i noticed this line in your script:

readfile('$myfile');

change it to either:
readfile($myfile);
or
readfile("$myfile");

variables inside of single quotes are not expanded in php, the contents inside single quotes is a litteral, so your trying to read a file litterally named $myfile