Download from BLOB is corrupt

bellamys

Hi,

I've managed to successfully upload files into a BLOB field in a MySQL database.
However, when attemting to download the files using PHP, the files are always corrupt.
I have verified that the uploaded files are not corrupt by using a perl script to extract the files from the BLOB field.

Any ideas why the files are corrupted when downloading via PHP?

My code is as follows:

<?php
include "session.php";
session_write_close();

$FILE_ID = $GET['FILE_ID'];
$FILE_NAME = $GET['FILE_NAME'];
$FILE_TYPE = $GET['FILE_TYPE'];
$FILE_SIZE = $GET['FILE_SIZE'];

header("Content-Transfer-Encoding: binary");
header("Content-length: $FILE_SIZE");
header("Content-type: $FILE_TYPE");
header("Content-Disposition: attachment; filename=$FILE_NAME");

include "db-connect.php";

$SQL_SELECT_FILE = "SELECT FILE FROM FILE WHERE FILE_ID = '$FILE_ID'";
$viewSQL = mysql_query($SQL_SELECT_FILE);

$FILE_FILE = mysql_result($viewSQL, 0, 0);

echo $FILE_FILE;
?>

MarkR

I recommend you use a binary file comparison program to compare the downloaded file with the uploaded one - of course they should be the same.

I'd have to suggest that the most likely cause is PHP inserting whitespace into the output. This could be caused by unwanted whitespace in either the above php file, or anything it includes (such as your session.php).

One option is to enable output buffering and then do an ob_clear() before sending the content; another is to remove all this unwanted whitespace.

Mark

PS: I couldn't help noticing, you're not escaping $FILE_ID in the above MySQL query - watch out for SQL injection vulnerabilities (casting it to an int would be safe).

bellamys

Hi MarkR,

Thanks for the reply.
Using a hex editor to compare the original and downloaded files, it appears that you were correct in suggesting that white space may be inserted into the downloaded file.

To cut a long story short, I removed all white space from all the files in the "include" statements, and it looks like the file "db-connect.php" file was causing the problem.

Thanks for the help...

Steven

MarkR wrote:
I recommend you use a binary file comparison program to compare the downloaded file with the uploaded one - of course they should be the same.

I'd have to suggest that the most likely cause is PHP inserting whitespace into the output. This could be caused by unwanted whitespace in either the above php file, or anything it includes (such as your session.php).

One option is to enable output buffering and then do an ob_clear() before sending the content; another is to remove all this unwanted whitespace.

Mark

PS: I couldn't help noticing, you're not escaping $FILE_ID in the above MySQL query - watch out for SQL injection vulnerabilities (casting it to an int would be safe).