PHP - Problem with FileUploading

[thatshanekid]

Hello again.
Well in my other post i posted on how i would be able to download the files i uploaded to the SQL database.
Well i got help from BuzzPHP from that, and now it downloads fine.
Just there is 1 little problem.
It corrupts every file it uploads.
Example:

I uploaded a TXT file just saying the words "randomtext" in it.
The auto-increment worked, and its ID was 10 (10th file i uploaded).
It uploaded, stored into the database.
I downloaded it, the filetype was fine, still in txt format.
I opened it..
Errr, the words it said in it was "10".
Im assuming the upload re-writes the file to the ID of the file? It basically corrupts all the files 🙁

So again , here is my code:

Download.php

<?php
if(isset($_GET['id'])) 
{
// if id is set then get the file with the id from database

$dbhost = "mysql"; //Database Host
			$dbuser = "12337_upload"; //Database User
			$dbpass = "****"; //Database Password
			$dbname = "12337_upload"; //Database Name

		//connect
		$db = mysql_pconnect($dbhost,$dbuser,$dbpass);
		mysql_select_db("$dbname",$db); 

include 'library/config.php';
include 'library/opendb.php';
$id    = $_GET['id'];
$query = "SELECT name, type, size, content " .
         "FROM upload WHERE id = '$id'";

$result = mysql_query($query) or die('Error, query failed');
list($name, $type, $size, $content) =                                  mysql_fetch_array($result);

header("Content-length: $size");
header("Content-type: $type");
header("Content-Disposition: attachment; filename=$name");
echo $size;

include 'library/closedb.php'; 
exit;
}

Upload.php

<form method="post" enctype="multipart/form-data">
<table width="350" border="0" cellpadding="1" cellspacing="1" class="box">
<tr> 
<td width="246">
<input type="hidden" name="MAX_FILE_SIZE" value="2000000">
<input name="userfile" type="file" id="userfile"> 
</td>
<td width="80"><input name="upload" type="submit" class="box" id="upload" value=" Upload "></td>
</tr>
</table>
</form>

<?php


		$dbhost = "mysql"; //Database Host
		$dbuser = "12337_upload"; //Database User
		$dbpass = "****"; //Database Password
		$dbname = "12337_upload"; //Database Name

		//connect
		$db = mysql_pconnect($dbhost,$dbuser,$dbpass);
		mysql_select_db("$dbname",$db); 

if(isset($_POST['upload']) && $_FILES['userfile']['size'] > 0)
{
$fileName = $_FILES['userfile']['name'];
$tmpName  = $_FILES['userfile']['tmp_name'];
$fileSize = $_FILES['userfile']['size'];
$fileType = $_FILES['userfile']['type'];

$fp      = fopen($tmpName, 'r');
$content = fread($fp, filesize($tmpName));
$content = addslashes($content);
fclose($fp);

if(!get_magic_quotes_gpc())
{
    $fileName = addslashes($fileName);
}
include 'library/config.php';
include 'library/opendb.php';

$query = "INSERT INTO upload (name, size, type, content ) ".
"VALUES ('$fileName', '$fileSize', '$fileType', '$content')";

mysql_query($query) or die('Error, query failed'); 
include 'library/closedb.php';

echo "<br>File $fileName uploaded<br>";
echo "<a href='/download.php?id=" . mysql_insert_id() . "'>Click Here</a>";
} 
?>

[cahva]

Ehm.. You are printing $size as the content.

header("Content-length: $size");
header("Content-type: $type");
header("Content-Disposition: attachment; filename=$name");
echo $size; // maybe echo $content? :)

BTW, what does library/opendb.php contain? As I see you are doing the database connection already earlier.

Dont trust the $_GET['id'] and never use it straight in your query. Atleast use mysql_real_escape_string to it before using it in your query and even better, check that its numerical.