Header

[FadeToLife]

I've been trying to download a file with the help of the header function, but

<?php
if(isset($_GET['download'])){
    echo "OK1";
    if(!strstr($_GET['download'], '..')){
        echo "OK2";
        $bestand = $_GET['download'];
        if(file_exists($dir.$bestand)){
            echo "OK3";
                header("Content-Description: File Transfer");
                header("Content-Type: application/force-download");
                header("Content-Disposition: attachment; filename=".$bestand."");
                header("Content-Length: ".filesize($dir.$bestand));
                readfile($dir.$bestand);
        }else{
        header("Location: index.php?Pagina=persoonlijke_bestanden&melding=Dit is een ongeldig bestand om te downloaden!");
        }
    }else{
        header("Location: index.php?Pagina=persoonlijke_bestanden&melding=Dit is een ongeldig bestand om te downloaden!");
    }
}
?>

doens't not to work. If I delete all 4 header rules (under OK3), then everything will work, and there will be echo't: OK1OK2OK3, Because of that I know the file can be found, so it exists! If I use the 4 header rules in my code, I still get a downloadpopup, but if I download the file and open I get 'corrupt of invalid file'! And I have this problem with all files, excel, word, powerpoint etc.
Notice: I have placed on top of my page ob_start ();, and error reporting is on (all), and I get no error, so there isn't a coding error?

[wilku]

Do not output anything before sending headers - comment out all the echo statements and make sure <?php stays inf the first line with no spaces before it.

PHP should output a warning for this anyway if you have error_reporting(E_ALL);

[FadeToLife]

Nope, I don't get any warning, and I think it is because I'm using ob_start() en ob_end_flush. This usually 'stops headers allready sent' errors. But if I put the code on top of the whole page (and I delete the OK1, OK2,...), the result still is not working

[wilku]

The problem must be somewhere else. The following script works fine (on my localhost):

<?php
$dir = "";
if(isset($_GET['download'])){
    //echo "OK1";
    if(!strstr($_GET['download'], '..')){
        //echo "OK2";
        $bestand = $_GET['download'];
        if(file_exists($dir.$bestand)){
            //echo "OK3";
                header("Content-Description: File Transfer");
                header("Content-Type: application/force-download");
                header("Content-Disposition: attachment; filename=".$bestand."");
                header("Content-Length: ".filesize($dir.$bestand));
                readfile($dir.$bestand);
        }else{
        echo "error";
        //header("Location: index.php?Pagina=persoonlijke_bestanden&melding=Dit is een ongeldig bestand om te downloaden!");
        }
    }else{
          echo "error";
        //header("Location: index.php?Pagina=persoonlijke_bestanden&melding=Dit is een ongeldig bestand om te downloaden!");
    }
}
?>

[FadeToLife]

Hmm, weird:

This is my script:

$dir = "gebruikers/bestanden/".$_SESSION['gebruiker']."/";
if(isset($_GET['download'])){
    //echo "OK1";
    if(!strstr($_GET['download'], '..')){
        //echo "OK2";
        $bestand = $_GET['download'];
        if(file_exists($dir.$bestand)){
            //echo "OK3";
                header("Content-Description: File Transfer");
                header("Content-Type: application/force-download");
                header("Content-Disposition: attachment; filename=".$bestand."");
                header("Content-Length: ".filesize($dir.$bestand));
                readfile($dir.$bestand);
        }else{
        echo "error";
        //header("Location: index.php?Pagina=persoonlijke_bestanden&melding=Dit is een ongeldig bestand om te downloaden!");
        }
    }else{
          echo "error";
        //header("Location: index.php?Pagina=persoonlijke_bestanden&melding=Dit is een ongeldig bestand om te downloaden!");
    }
}

But the weird thing is: the file can be found (so the dir path is correct), because I get no error.
Also, the page where I use this script is being included, but oncemore, I do not get an error, not a PHP-one and not one that says that the file is found.
So
-The file path is correct (so it doesn't matter how many times the file is being included in another file, I get no error, so the path stays the same!)
-No header error's are been made, because otherwise, I get a headers already sent error!

[wilku]

One more thing that comes into my mind - try not sending the headers once and see if readfile itself gives any error. Maybe it's some kind of permissions error, which are not shown because of the headers?