Okay, so I managed to get my file download script working. I'm not sure what the issue was, but I did learn somewhere along the way that if you don't send the "content-type" header first, IE7 tends to insert its own "text" header. I don't think that was the only problem in my original code, but it was a biggie.
Anyway, my files did end up getting stored in the URL path, but they are stored as random strings without any extension and the user never sees the random string. Both the original file name and the random string are stored in the database and I convert them as needed.
The handler for the upload looks like this:
if(file_exists($_FILES["file"]["tmp_name"])) // Is there a file to upload?
{
if($_FILES["file"]["size"] > 1000000) // Is file over the 1 MB size limit?
{
$up_msg = "File size is over the limit. Upload cancelled.";
}
else // File size okay!
{
if($_FILES["file"]["type"] == "application/octet-stream") // Is file an executable?
{
$up_msg = "Executable files not allowed. Upload cancelled.";
}
else // File isn't executable!
{
if($_FILES["file"]["error"] > 0) // Are there any other errors?
{
$up_msg = "Error: ".$_FILES["file"]["error"];
}
else // Passed all the tests!
{
$uploadpath = "inet/www/uploads/"; // Set upload folder path
$tmpname = $_FILES["file"]["tmp_name"]; // Get temp file name (set by php)
$filename = $_FILES["file"]["name"]; // Get original file name
$hashname = make_hash($filename); // Create encrypted file name
$fullpath = $uploadpath.$hashname; // Set full file storage path
// Move the file from the temp folder to the upload folder
if(move_uploaded_file($_FILES["file"]["tmp_name"], $fullpath) > 0)
{
// If file doesn't get moved, it gets deleted from the /tmp/ folder automatically
$up_msg = "Some problem uploading file.";
}
}
}
}
}
Here is the code for the download page:
if(isset($_SESSION['q_filename']) && isset($_SESSION['q_hashname'])) // Make sure file is queued in session
{
// File queued in session, change to local variables
$filename = $_SESSION['q_hashname']; // Get stored hash name
unset($_SESSION['q_hashname']);
$downloadname = $_SESSION['q_filename']; // Get file name (filename presented to user)
unset($_SESSION['q_filename']);
$filepath = "/inet/www/uploads/"; // Set the base file path
$fullpath = $filepath.$filename;
// Start the download...
header('Content-Type: application/octet-stream');
header('Content-Description: File Transfer');
header('Content-Length: ' . filesize($fullpath));
header("Content-Disposition: attachment; filename=\"".$downloadname."\"");
readfile($fullpath);
I hope this can help others who are struggling with file handling. If anyone has any other input, please feel free to post it.
