So far here what i've tried it can download the sql file but it is empty
//test.php
<?php
header("Content-type: application/octet-stream");
header('Content-Disposition: attachment; filename=wordpress_db1.sql');
?>
Here is what my root folder look like
I want to download the wordpress_db1.sql file when I run the test.php but I always get empty on it. How can I fix this? thanks!
Below code will do the trick for you.
<?php
$file_name = 'file.sql';
$file_url = 'http://www.example.com/' . $file_name;
header('Content-Type: application/octet-stream');
header("Content-Transfer-Encoding: Binary");
header("Content-disposition: attachment; filename=\"".$file_name."\"");
readfile($file_url);
?>
What have you gone wrong is readfile($file_url);. Setting headers will not get the job done. you have use readfile($file_url);
Setting the headers doesn't read the file. You can name the file anything you want in the attachment. You have to actually emit the file:
readfile('wordpress_db1.sql');
Related
I'm being told to find the unsafe in this code and find a way to fix it.
Someone can help me ?
<?php
$file_url = 'upload/news'.$_GET['file'];
header('Content-type: application/octet-stream');
header("Content-Transfer-Encoding: Binary");
header("Content-disposition: attachment; filename=\"". basename($file_url)."\"");
readfile($file_url);
?>
The $_GET['file'] usage in the $file_url exposes the code to path traversal attacks. This is quite a dangerous setup, any file in the news directory can be read, if you place sensitive files like .env in the news folder they can be read!
If all content should be public you can use pathinfo to ensure you only get filenames. Checkout the following example:
$fileName = basename($GET['file']);
$fileUrl = 'upload/news/'. $fileName
header('Content-type: application/octet-stream');
header("Content-Transfer-Encoding: Binary");
header("Content-disposition: attachment; filename=\"". $fileName."\"");
readfile($fileUrl);
basename is safe to use in this case because it removes any path part that could be used for path traversal
basename("../test.php"); // test.php
basename("."); // .
basename("../.."); // ..
basename("../../test.php"); // test.php
I am trying to download a file. I am using IE11. I have tried several methods to do this. Currently I am trying to use the header with Content-Disposition method. I have tried to do this a few different ways according to other answers people have given. And it does download. But instead of downloading the file I point it to, it downloads the file it is written in. So if I tell it to download example.txt in my test.php file. It will only download test.php.
These are the methods I have tried:
This one is written in test.html:
<?php
$filename = "example.txt"
header('Content-Type: text/plain');
header('Content-Disposition: attachment; filename="' . basename($filename) . '"');
?>
I've also tried making it a button:
BUTTON
Where download.php is:
<?php
$file = $_GET['file'];
header('Content-type: audio/mpeg');
header('Content-Disposition: attachment; filename="'.$file.'"');
?>
I tried this:
<?php
header('Content-Type: application/download');
header('Content-Disposition: attachment; filename="example.txt"');
header("Content-Length: " . filesize("example.txt"));
$fp = fopen("example.txt", "r");
fpassthru($fp);
fclose($fp);
?>
And this:
header("Content-Disposition: attachment; filename=\"" . basename($File) . "\"");
header("Content-Type: application/force-download");
header("Content-Length: " . filesize($File));
header("Connection: close");
There are many more slight variations and mix and matching that I have tried. All have the same problem that the .html or .php file downloads rather than example.txt. Does anyone know why this would happen? Is something not supported in IE11? I do not think it is a syntax error simply because most of these I copied from other answers online. I have tried with example.txt existing and not existing, in this folder and other folders.
EDIT: So it turns out that these all work, I was just using them wrong. I had been trying to make isolated files to run this code so I could test it without interference from the rest of the functions on my website, but this left the php files without the resources they needed to actually run properly. When I put the code into the actual files on the website it worked perfectly. smh
Try this :
header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Length: ' . filesize($File));
header('Content-Disposition: attachment; filename=' . basename($File));
readfile($File);
exit;
I'm creating a doc file with the php.
I'm using echo to output everything but I can see that my html is properly created in my response but the download is not starting.
How can I make this download to start?
Part of my code:
header('Content-Description: File Transfer');
header("Content-type: application/msword; charset=utf-8");
header("Content-Disposition: attachment;Filename=test.doc");
echo $main_html; //html code
I tested this, and it works perfect.
file_put_contents("test.doc",$main_html);
header('Content-Description: File Transfer');
header("Content-type: application/msword; charset=utf-8");
header("Content-Disposition: attachment;Filename=test.doc");
readfile("test.doc");
unlink("test.doc");
die;
Note : if you may already know, header only works before passing any output to the browser, including line break and even a space .
Use this:
header("Content-Type: text/html");
header("Content-Disposition: attachment; filename=read.html;");
header("Content-Transfer-Encoding: binary");
echo $html;
Your code works fine for me.. I ran this on my server
<?php
$main_html = "<h1>Hey I'm Nate</h1>"; // I did put this in
header('Content-Description: File Transfer');
header("Content-type: application/msword; charset=utf-8");
header("Content-Disposition: attachment;Filename=test.doc");
echo $main_html; //html code
Did you define $main_html before echoing? Because all I changed was added some html to it.
It started a download right away, with the correct content in the document.
To start an download, you have to use the content-type application/octet-stream to start an download as mentioned in RFC 2046.
Btw. you have to echo the content of the doc file and not your html content(i.e. use readfile('test.doc') as mentioned in other answers or simply echo the content of your doc file)
I have a very simple hide-download-path-script setup like this:
On index.html I have this link:
save
On savefile.php I have this bit of code:
$file = 'http://www.mysite.com/files/correct_horse_battery_staple.rar';
header("Content-Type: application/force-download");
#readfile($file);
This does seems to work, but unfortunately it downloads the file as savefile.php rather than correct_horse_battery_staple.rar.
Is there any way to change not only the file name but also the extension?
I have had same problem
Solved as below:
header("Content-Type: application/force-download");
header('Content-Disposition: attachment; filename="'.$filename.'"');
readfile($filename);
I hope it help u
Your link goes to savefile.php, and the browser never got another filename than savefile.php.
You need to add a header like:
header('Content-Disposition: attachment; filename="correct_horse_battery_staple.rar"');
or better...
header('Content-Disposition: attachment; filename="'.basename($file).'"');
Hope it helps!
I want to allow a user to download a pdf file, the download code is below....for some odd reason even though the file is being downloaded I get an error saying that the file has been damaged on the server...Could someone help me and point out where I am making my mistake.
<php
$name = $_POST["name_first"];
$mail = $_POST['email'];
$number = $_POST['phone_number'];
$email_message = "first name: {$name} email is {$mail} number is {$number} ";
mail('fanaa#gmail.com', 'Form Response', $email_message);
if ($mail == "" OR $name == "" OR $number == "")
{
echo "Enter valid details ";
}
else
{
header('Content-type: application/pdf');
header('Content-Disposition: attachment; filename="tokina.pdf"');
readfile('docs/tokina.pdf');
}
?>
I used this code to download pdfs:
header ("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header('Content-Type: application/octetstream');
header("Content-Transfer-Encoding: Binary");
header("Content-length: ".filesize($file));
header("Content-disposition: attachment; filename=\"".basename($filename)."\"");
readfile("$file");
}
This should be fine, and make sure there are no spaces or return characters (don't escape php at all is the best solution).
If you find your still having problems, open the corrupted file with notepad (there may be a php error warning inside).
Hope this helps!
Remove the headers and look at the page, do you see any error messages? If PHP outputs anything else than the actual PDF source, the file will appear to be corrupted.
header('Content-type: application/pdf');
enable PHP extension php_gettext and you are done.
try taking out the double quotes in
header('Content-type: "application/octet-stream"');
so it becomes
header('Content-type: application/octet-stream');
Maybe your content-type is not correct. try this one:
header('Content-type: application/pdf');
header('Content-Disposition: attachment; filename="downloaded.pdf"');
readfile('original.pdf');
Your PDF file tokina.pdf is either not uploaded or not in the same directory as the PHP file. That's why it's saving as "tokina.pdf.htm" - it's loading the HTML for a 404 page instead. That is why your browser/PDF viewer thinks the file is "corrupted" - because its extension is PDF but its contents are not.
Make sure the file is uploaded, and if it is, make sure readfile is pointing to the correct path. If it's not in the same folder, use a relative/absolute path, for example:
readfile('docs/tokina.pdf');
And yes, the content type should be application/pdf
Using this script
header('Content-Type: application/force-download');
header('Content-Disposition: attachment; filename='.$filename);
header('Content-Transfer-Encoding: binary');
header('Content-Length: '.filesize($filenamepath));
readfile($filenamepath);
I had the same problem. Comparing the original file and the downloaded file with a hexadecimal editor like UltraEdit, I found some characters at the beginning of the corrupted file.
The problem was that after ?> marking end of PHP code there were line terminators several times in my code.
Remove all the line terminators after ?> and read also the forum article Downloaded Files are corrupt - Common Problem. That worked for me.
I hope that can help you.
I use
$download_path = your path (where to look for the files)
set_time_limit(0);
$file_url = $download_path . $data['link'];
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="' . basename($file_url). '"');
//then to read the file
readfile($file_url);
this usually works for me