Member Avatar for larry29936

My main download page passes an id number for the file to be downloaded. In the mydloader.php (located in the download folder), I have a pdo sql query to set $l_filename to the filename in the database. I need to use $l_filename in <a href to download the file. My code follows:

<?php

$php_scripts = '../../php/';
require $php_scripts . 'PDO_Connection_Select.php';
require $php_scripts . 'GetUserIpAddr.php';
function mydloader($id=NULL)

{
$ip = GetUserIpAddr();
if (!$pdo = PDOConnect("foxclone_data"))
{   
    exit;
}

    $stmt = $pdo->prepare('SELECT filename FROM files WHERE id =?');
    $stmt->execute([$id]);
    $l_filename = $stmt->fetch();

    if( isset( $l_filename ) ) {  
        <a href="">
        $ext = pathinfo($l_filename, PATHINFO_EXTENSION);
        $stmt = $pdo->prepare("INSERT INTO download (address, filename,ip_address) VALUES (?, ?, inet_aton('$ip'))");
        $stmt->execute([$ip, $ext]) ; 

        $test = $pdo->query("SELECT id FROM lookup WHERE INET_ATON('$ip') BETWEEN start AND end ORDER BY start DESC, end DESC");
        $ref = $test->fetchColumn();
        $ref = intval($ref);

        $stmt = $pdo->prepare("UPDATE download SET ref = '$ref' WHERE address = '$ip'");
        $stmt->execute() ;         
       }

    else {
        echo "isset failed";
        }  
}
mydloader($_GET["f"]);
exit;

Thanks in advance

  • 4 Contributors
  • 6 Replies
  • 187 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by larry29936

Dani AI

Generated

If the filename comes from the database, there are two common, safe ways to let users download it: 1) render a link that points to the file (URL-encoded so spaces and special chars don’t break the URL), or 2) (recommended) point the link to a server-side download endpoint that looks up the filename by id and streams the file with proper headers. ’s suggestion fixed the immediate problem of characters in the URL, but a download script gives you control, prevents exposing paths, and lets you enforce security checks and logging.

Checklist before sending any file:

  • Validate the incoming id (FILTER_VALIDATE_INT) and use a prepared statement to fetch the single filename (fetchColumn).
  • Never trust the filename raw from the DB: sanitize with basename(), build an absolute path from a dedicated storage directory (preferably outside webroot), then use realpath() and ensure the resolved path starts with your storage directory to prevent traversal.
  • Check is_file/readable and optionally restrict allowed extensions or MIME types.
  • Serve with headers: Content-Type, Content-Length and Content-Disposition to force download with a safe filename.

Example download endpoint (serve by id, not by exposing the raw filename):

<?php
require '../../php/PDO_Connection_Select.php';

$id = filter_input(INPUT_GET, 'f', FILTER_VALIDATE_INT);
if (!$id) { http_response_code(400); exit; }

$pdo = PDOConnect('foxclone_data');
$stmt = $pdo->prepare('SELECT filename FROM files WHERE id = ? LIMIT 1');
$stmt->execute([$id]);
$filename = $stmt->fetchColumn();
if (!$filename) { http_response_code(404); exit; }

$baseDir = realpath(__DIR__ . '/files'); // storage folder
$full = realpath($baseDir . DIRECTORY_SEPARATOR . basename($filename));
if (!$full || strpos($full, $baseDir) !== 0 || !is_file($full)) { http_response_code(404); exit; }

$mime = mime_content_type($full) ?: 'application/octet-stream';
header('Content-Type: ' . $mime);
header('Content-Length: ' . filesize($full));
header('Content-Disposition: attachment; filename="' . basename($filename) . '"');

readfile($full);
exit;
?>

If you prefer a direct HTML link (simpler but less flexible), point it to this endpoint by id rather than the raw filename so you keep filenames private and let PHP set proper headers. Also consider X-Sendfile / X-Accel-Redirect for large files to avoid PHP memory/time limits.

Recommended Answers

All 6 Replies

Member Avatar for urtrivedi
  1. What you are showing seems to be file upload part.
  2. File content function not visible in your script. i.e. move_uploaded_file() to be moved to your folder.
  3. Href link to download file can be rendered in html emebded with php loop of file table.

echo "<a href='http:domain/contentfolder/{$filename}' target='_blank'>download file here<a>";

Member Avatar for ajbest

I think you are looking for echo. So something like

echo ‘<a href=“‘.$l_filename.’”>click here</a>’;

Member Avatar for Dani

In the line $l_filename = $stmt->fetch(); does $l_filename what is an example of what it gets set to? A complete URI, just a filename, filepath + filename, etc.?

Member Avatar for larry29936

Dani, $l_filename is the actual filname (ex: test.iso) located in the same directory as the php code

Member Avatar for Dani

If it’s in the same directory, then you can do:

echo ‘<a href=“‘, rawurlencode($l_filename) , ’”>click here</a>’;

Member Avatar for larry29936

Thanks Dani, that worked.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.