Prøv denne - med indbygget sikkerhed:
<?php
/*******************************************************************
* Force download script:
* Save this script as i.e. download.php
*
* Tested on Mozilla, Netscape 4.78 and 6.21, Internet Explorer 5.5, lynx,
* Konqueror and Opera. It works fully on all.
*
* Usage: download.php?filename=name_of_file.extension
* or
* <a href="download.php?data.pdf">Download data</a>.
* You can also use paths in the filename, as in
* <a href="download.php?../include/data.pdf">Download data</a>.
*
* You can specialise the code by putting a line of the form
* $filename="data.pdf"; immediately after this comment.
* This will allow you to send exactly one file for download, viz data.pdf.
*******************************************************************/
$filename = isset($_GET['filename']) ? $_GET['filename'] : "";
$shortname = basename( $filename );
if( file_exists( $filename ) // sanity check
&& !eregi( "p?html?", $filename ) // security check
&& !eregi( "inc", $filename )
&& !eregi( "php3?", $filename ) ){
$size = filesize( $filename );
header("Pragma: no-cache");
header("Expires: 0");
header("Content-Transfer-Encoding: binary");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0\r\n");
header("Cache-Control: no-cache, must-revalidate");
header("Content-Type: application/save");
header("Content-Disposition: attachment; filename=$shortname");
$fh = readfile("$filename");
fpassthru($fh);
exit;
} else {
print "The file $shortname is not available for download";
}
?>
