Forum Topic: Php: Forced Download

(1,114 views • 19 replies)

This topic is 1 page long.

<< < > >>
None

DannyIsOnFire

Reply To Post Reply & Quote

Posted at: 8/13/06 12:04 PM

DannyIsOnFire DARK LEVEL 18

Sign-Up: 04/14/05

Posts: 6,803

PHP: Main

In this small tutorial, we are going to learn how to force a viewer to download a file when they click a link.

For example, if you want your viewers to be able to download the file image.jpg, you can use the code below, and the file image.jpg wont open in the browser.

To understand this tutorial you will need some basic knowledge of PHP and HTML.

So, on with the tutorial.

Make a new file called forceddownload.php and write the following script in it.

<?
// Tells the browser that where going to run a PHP script.
$file = $_GET['file'];
// Get a filename from the GET parameters.
header ("Content-type: octet/stream");
header ("Content-disposition: attachment; filename=".$file.";");
header("Content-Length: ".filesize($file));
// Sends the brower headers to tell it that it is sending that file back to it.
readfile($file);
// Reads the file from the server and send it to the browser.
exit;
?>
// Closes the PHP script.

Next, on the page you want to link the download from, we have the HTML that will link to the file.

<a href="forceddownload.php?file=image.jpg">D
ownload image.jpg</a>

Thats it.

You should now be able to click the link, and instead of the file opening, it will download.

Thanks to Cheeries for proof reading this tutorial =)

Brought to you by DannyIsOnFire.
www.dannyisonfire.com


None

thecoshman

Reply To Post Reply & Quote

Posted at: 8/13/06 12:22 PM

thecoshman DARK LEVEL 11

Sign-Up: 06/11/06

Posts: 812

oh... looks very nice.

Im just not sure how usefull the link is, appart from maybe a link to download a page or somthing.


None

elbekko

Reply To Post Reply & Quote

Posted at: 8/13/06 12:37 PM

elbekko EVIL LEVEL 16

Sign-Up: 07/23/04

Posts: 6,588

At 8/13/06 12:22 PM, thecoshman wrote: oh... looks very nice.

Im just not sure how usefull the link is, appart from maybe a link to download a page or somthing.

It's very, very useful ;)
I'll give an example:
You have a log stored in a DB. you want to output it to a downloadable text file. You just send these headers and echo whatever is needed ;)

"My software never has bugs. It just develops random features. " - Unknown

[ FluxBB developer | Quickmarks 0.5.1 | Strings & Ints - my blog ]

BBS Signature

None

cherries

Reply To Post Reply & Quote

Posted at: 8/13/06 02:34 PM

cherries LIGHT LEVEL 18

Sign-Up: 06/07/05

Posts: 4,577

Yes my name is cheeries >:C


None

DannyIsOnFire

Reply To Post Reply & Quote

Posted at: 8/13/06 02:42 PM

DannyIsOnFire DARK LEVEL 18

Sign-Up: 04/14/05

Posts: 6,803

At 8/13/06 02:34 PM, -cherries- wrote: Yes my name is cheeries >:C

Bah, top set english and cant spell cherries :)
Im sure everyone knew what i meant, regardless of what i said.


None

henke37

Reply To Post Reply & Quote

Posted at: 8/13/06 05:28 PM

henke37 NEUTRAL LEVEL 20

Sign-Up: 09/10/04

Posts: 3,173

Now to add security. Would be kinda bad if somebody downloaded your passwords right?

Each time someone abuses hittest, God kills a kitten. Please, learn real collision testing.


None

DFox

Reply To Post Reply & Quote

Posted at: 8/13/06 05:31 PM

DFox LIGHT LEVEL 30

Sign-Up: 08/09/03

Posts: 9,460

I like this tutorial a lot. It can be VERY useful

At 8/13/06 05:28 PM, henke37 wrote: Now to add security. Would be kinda bad if somebody downloaded your passwords right?

Once again, tutorials are for learning purposes. You're not really supposed to use them for real, but rather use the concept.

All though I do agree a simple check to make sure the file being sent to the script is on your server would help :)


None

NinoGrounds

Reply To Post Reply & Quote

Posted at: 8/20/06 06:51 PM

NinoGrounds DARK LEVEL 17

Sign-Up: 11/28/05

Posts: 3,678

Great tutorials, I will use for downloading all types of files, even .php.

I don't need to ZIP anymore - this great!


None

henke37

Reply To Post Reply & Quote

Posted at: 8/21/06 05:38 AM

henke37 NEUTRAL LEVEL 20

Sign-Up: 09/10/04

Posts: 3,173

Do note that php scripts stops runing after X secs, to prevent infinite loops. There is a function that tells php that it should allow long executions.

Each time someone abuses hittest, God kills a kitten. Please, learn real collision testing.


None

NinoGrounds

Reply To Post Reply & Quote

Posted at: 8/25/06 03:45 PM

NinoGrounds DARK LEVEL 17

Sign-Up: 11/28/05

Posts: 3,678

At 8/21/06 05:38 AM, henke37 wrote: Do note that php scripts stops runing after X secs, to prevent infinite loops. There is a function that tells php that it should allow long executions.

I always wondered, so now I'm gonna ask:
why is this related?

Well that function is called set_time_limit()


None

Sir-Davey

Reply To Post Reply & Quote

Posted at: 8/25/06 04:07 PM

Sir-Davey FAB LEVEL 19

Sign-Up: 07/09/01

Posts: 3,100

Cool, I've been wondering just what header to send to do this.

Although do yourself a favor, don't copy and paste this script without sanitizing it. I could download you config.php files, or whatever else I want that's on your server, including password files for the linux server depending on permissions.


None

DannyIsOnFire

Reply To Post Reply & Quote

Posted at: 8/25/06 04:26 PM

DannyIsOnFire DARK LEVEL 18

Sign-Up: 04/14/05

Posts: 6,803

At 8/25/06 04:07 PM, Sir-Davey wrote: Cool, I've been wondering just what header to send to do this.

Although do yourself a favor, don't copy and paste this script without sanitizing it. I could download you config.php files, or whatever else I want that's on your server, including password files for the linux server depending on permissions.

I think you can only download the files that are in the same folder as foceddownload.php
So if you put only the files you want to be downloadable, you should have a problem.

should you ?

None

Sir-Davey

Reply To Post Reply & Quote

Posted at: 8/25/06 04:36 PM

Sir-Davey FAB LEVEL 19

Sign-Up: 07/09/01

Posts: 3,100

At 8/25/06 04:26 PM, DannyIsOnFire wrote: I think you can only download the files that are in the same folder as foceddownload.php
So if you put only the files you want to be downloadable, you should have a problem.

should you ?

What's stopping me from putting ../config.php as the file name?

Just make a list of files that are allowed to be downloadable, or escape /'s


None

henke37

Reply To Post Reply & Quote

Posted at: 8/26/06 05:57 AM

henke37 NEUTRAL LEVEL 20

Sign-Up: 09/10/04

Posts: 3,173

if(substr(dirname(realpath($file)), 0, strlen($basepath))==$basepath) {
allowdownload():
}

Each time someone abuses hittest, God kills a kitten. Please, learn real collision testing.


None

VigilanteNighthawk

Reply To Post Reply & Quote

Posted at: 8/26/06 06:13 AM

VigilanteNighthawk LIGHT LEVEL 03

Sign-Up: 02/13/03

Posts: 1,665

Excellent script. I can definitely forsee using it.


None

thecoshman

Reply To Post Reply & Quote

Posted at: 10/30/06 05:18 PM

thecoshman DARK LEVEL 11

Sign-Up: 06/11/06

Posts: 812

few things.

1) can this be used to force download of php files, befor they are passed by the server, if so

2) can you use this to force the downlaod of a php page on another server, if so

3) this is a HUGE sercurity flaw! I could get your php scripts and know you SQL username and password anf shit, thus do WTF I want to your data!!!

Im scared!


None

thecoshman

Reply To Post Reply & Quote

Posted at: 10/31/06 08:08 AM

thecoshman DARK LEVEL 11

Sign-Up: 06/11/06

Posts: 812

well, that is a relief


None

elbekko

Reply To Post Reply & Quote

Posted at: 10/31/06 08:10 AM

elbekko EVIL LEVEL 16

Sign-Up: 07/23/04

Posts: 6,588

The only thing you should ever use from that script are the headers :P

"My software never has bugs. It just develops random features. " - Unknown

[ FluxBB developer | Quickmarks 0.5.1 | Strings & Ints - my blog ]

BBS Signature

None

different

Reply To Post Reply & Quote

Posted at: 11/11/06 01:10 PM

different DARK LEVEL 35

Sign-Up: 07/08/04

Posts: 3,764

If you try to download php the browser will generate a html page echoing the output of the php (if any).

we play iPhone, daily game reviews, twitter.


None

Taylor

Reply To Post Reply & Quote

Posted at: 11/11/06 01:45 PM

Taylor LIGHT LEVEL 09

Sign-Up: 08/19/03

Posts: 8,515

At 11/11/06 01:10 PM, different wrote: If you try to download php the browser will generate a html page echoing the output of the php (if any).

Not if you're using force-download it won't.


All times are Eastern Daylight Time (GMT -4) | Current Time: 03:27 AM

<< Back

This topic is 1 page long.

<< < > >>
You need a Grounds Gold Account to post on the NG BBS! If you don't have one, click here to sign up now! It's fast, free, and easy — and opens up tons of great NG features!