php mysql download link - php

Question

On this page, a user picks some options from drop downs and receives a list of files available for download. Download hyperlink next to each record. Currently the download hyperlink downloads a file with the correct FILE NAME as it exists in the database, but the file CONTENTS are incorrect. More specifically, it seems like a header is not being sent correctly: The contents of the file is the html markup from newpub_profile.php
This is the most current code:
newpub_profile.php
$q = "SELECT upload_id, title, genre, length, created
FROM upload
WHERE genre = '$genre' AND length = '$length'
ORDER BY created DESC, title DESC";
$r = mysqli_query ($dbc, $q); // Run the query
if($r)
{
// If it ran okay, display the records
echo '<table align="center"
cellspacing="3" cellpadding="3"
width="75%">
<tr><td align="left"><b>Title</b></td>
<td align="left"><b>Genre</b></td>
<td align="left"><b>Pages</b></td>
<td align="left"><b>Submitted</b></td>
<td align="left"><b>Download</b></td>';
// Fetch and print all the records:
while ($row = mysqli_fetch_array($r,MYSQLI_ASSOC))
{
echo '<tr><td align="left">' .
$row['title'] . '</td><td align="left">'
. $row['genre'] . '</td><td align="left">'
. $row['length'] . '</td><td align="left">'
. $row['created'] . '</td><td align="left">'
//. $row['views'] . '</td><td align="left">'
. "<a href='newpub_profile.php?id={$row['upload_id']}'>Download</a></td>" . '</td></tr>';
}
echo '</table>'; // Close the table
mysqli_free_result ($r); // Free up the resources
}
else // If it did not run okay
{
// Public Message:
echo '<p class="error">Your submissions could not be retrieved. We
apologize for any inconvenience.</p>';
// Debugging message:
echo '<p>' . mysqli_error($dbc) . '<br /><br />Query: ' . $q . '</p>';
} // End of if ($r) IF.
}
//END DOWNLOAD HANDLER ******************************************************
mysqli_close($dbc); // Close the database connection
?>
<?php
// Make sure an ID was passed DOWNLOAD HANDLER *******
if(isset($_GET['id'])) {
// Get the ID
$id = intval($_GET['id']); var_dump($id);
require_once ('../mysqli_connect.php'); //Connect to the db
// Fetch the file information
$downloadq = "
SELECT `file_type`, `size`, `title`, 'content', 'upload_id'
FROM `upload`
WHERE `upload_id` =".$id;
$result = mysqli_query ($dbc, $downloadq); // Run the query
if($result) {
// Make sure the result is valid
if (mysqli_num_rows($result) > 0) {
// Get the row
$row = mysqli_fetch_assoc($result);
//var_dump($row);
// Print headers
header("Content-Type: ". $row['type']);
header("Content-Length: ". $row['size']);
header("Content-Disposition: attachment; filename=". $row['title']);
// Print data
echo stripslashes($row['content']);
}
else {
echo 'Error! No such ID.';
}
// Free the mysqli resources
mysqli_free_result($result);
}
else {
echo "Error! Query failed: <pre>{$dbc->error}</pre>";
}
mysqli_close($dbc);
}
?>
newupload_sql.php
if(isset($_POST['upload']) && $_FILES['userfile']['size'] > 0) //check membership level here*******************************************
{
//------------------------------------------------------------------------------------------------
//$membercheck = "SELECT membership, uploaded
// FROM user
// WHERE user_id =". $_SESSION['user_id']; //gets membership level and upload count
//-----------------------------------------------------------------------------------------------
if($_FILES['userfile']['size'] > 2621440)
die("File larger than 2.5MB");
$mimeTypes = array('application/vnd.openxmlformats-officedocument.wordprocessingml.document',
'application/msword');
if (in_array($_FILES['userfile']['type'], $mimeTypes))
{
$fileName = $_FILES['userfile']['name'];
$tmpName = $_FILES['userfile']['tmp_name'];
$fileSize = $_FILES['userfile']['size'];
$fileType = $_FILES['userfile']['type'];
$oid = $_SESSION['user_id'];
$views = 0;
$fp = fopen($fileName, 'r');
$content = fread($fp, filesize($fileName));
$content = addslashes($content);
fclose($fp);
//if(!get_magic_quotes_gpc())
//{
// $fileName = addslashes($fileName);
//}
$query = "INSERT INTO upload (title, file_type, size, content, length, genre, created, views, description, owner_id) ".
"VALUES ('$fileName', '$fileType','$fileSize', '$content', '$length', '$genre', NOW(), '$views', '$description', '$oid')";
$r = #mysqli_query ($dbc, $query); //Run the query. or die('Error, query failed');
if($r)
{
require_once ('login_functions.php');
$url = absolute_url ('newupload_thanks.php');
header("Location: $url");
exit();
}
else //if it didnt run ok...
{
//Public message:
echo '<h1>System Error</h1>
<p class="error">You could not upload due to a system
error. We apologize.</p>';
//debugging message:
echo'<p>' . mysqli_error($dbc) . '<br /><br />Query: ' . $r .
'</p>';
} // End of ($r) IF. // File's OK
}
}
else
{
die("Wrong tile type: Use .doc, .docx or ONLY");
}
}mysqli_close($dbc); //Close the database connection.
?>

Answer 1

Are you sure it is downloading the page itself? From the looks of it your issue is that you are not building the header correctly. Your SQL query and var_dump indicates that you are fetching a title but you use name for filename of the download offer (actually making the code send a header with empty filename.
I'd suggest you verify that your code uses the actual column name. i.e.:
header("Content-Disposition: attachment; filename=". $row['title']);

Answer 2

There is no row['name'] do you mean row['title']

Answer 3

You have these
$fileName = $_FILES['userfile']['name'];
$tmpName = $_FILES['userfile']['tmp_name'];
You have to rename/move $tmpName to $filename
EDITED
Check this
move_uploaded_file()
or change $fileName with $tmpName in the following block
$fp = fopen($fileName, 'r');
$content = fread($fp, filesize($fileName));
$content = addslashes($content);
fclose($fp);