Problems with HTTP headers

[theresandy]

I'm trying to avoid anti-leeching for files on my website, and also check some stuff (via PHP) before the user can actually download anything, so I have a script that looks like: download.php?fileID=xxx

If the file is an image or a video, I do this:

            case "wmv": $ctype = "video/x-ms-wmv wmv"; break;
            case "mpg": $ctype = "video/mpeg"; break;
            case "mpeg": $ctype = "video/mpeg"; break;
            case "avi": $ctype = "video/x-msvideo"; break;
            case "mov": $ctype = "video/quicktime"; break;

        case "jpg": $ctype = "image/jpeg"; break;
        case "jpeg": $ctype = "image/jpeg"; break;
        case "gif": $ctype = "image/gif"; break;
        case "png": $ctype = "image/png"; break;
        case "bmp": $ctype = "image/bmp"; break;

and then:

       header("Content-type: $ctype");
       readfile($realFileURL);

I'm testing it for a jpg file, and it works, when I'm on download.php?fileID=xxx, I can see the image on the browser.
Problem is, when doing <img src="download.php?fileID=xxx"> it won't work.

Is header("Content-type: image/jpeg") not enough or wrong? Is there a better way than manually setting the headers for all video and image file extensions? Isn't there a way to let apache handle that?

Thanks in advance

[coreyp_1]

I usually use this header, too, after the first one:

header("Content-Disposition: inline; filename=$whatever_you_want_to_call_it");

[jara06]

theresandy, you might want to look at http://php.net/header. Search for the 'Content-Disposition' and after that, read the note by 'aarondunlap.com' in there.
He does something similar.
Anyway, that page contains LOTS of golden breadcrumbs 😉

[theresandy]

jara06 wrote:

theresandy, you might want to look at http://php.net/header. Search for the 'Content-Disposition' and after that, read the note by 'aarondunlap.com' in there.
He does something similar.
Anyway, that page contains LOTS of golden breadcrumbs 😉

Thanks, but I got it, it was a little bug of mine concerning REQUEST_URI 🙂