php file download script to download any file

PHP file download script to download any file:

Usage : <a href="download.php?file=<?php $filepath; ?>">Download</a> in above href you have to change "<?php echo $filepath; ?>" the following code with your file path, by this script you can download all types of files like documents, ext, videos, images, zip files etc.. <?php $file = $_GET['file']; download_file($file); function download_file( $fullPath ){ // Must be fresh start if( headers_sent() ) die('Headers Sent'); // Required for some browsers if(ini_get('zlib.output_compression')) ini_set('zlib.output_compression', 'Off'); // File Exists? if( file_exists($fullPath) ){ // Parse Info / Get Extension $fsize = filesize($fullPath); $path_parts = pathinfo($fullPath); $ext = strtolower($path_parts["extension"]); // Determine Content Type switch ($ext) { case "pdf": $ctype="application/pdf"; break; case "exe": $ctype="application/octet-stream"; break; case "zip": $ctype="application/zip"; break; case "doc": $ctype="application/msword"; break; case "xls": $ctype="application/vnd.ms-excel"; break; case "ppt": $ctype="application/vnd.ms-powerpoint"; break; case "gif": $ctype="image/gif"; break; case "png": $ctype="image/png"; break; case "jpeg": case "jpg": $ctype="image/jpg"; break; default: $ctype="application/force-download"; } header("Pragma: public"); // required header("Expires: 0"); header("Cache-Control: must-revalidate, post-check=0, pre-check=0"); header("Cache-Control: private",false); // required for certain browsers header("Content-Type: $ctype"); header("Content-Disposition: attachment; filename=\"".basename($fullPath)."\";" ); header("Content-Transfer-Encoding: binary"); header("Content-Length: ".$fsize); ob_clean(); flush(); readfile( $fullPath ); } else die('File Not Found'); } ?>

Check Out here:

• There is a security problem, should closed "application/force-download" Content-Type! which can download anything including server PHP source!.
• To get around the security problem, don't take absolute or relative path information from the request; only get the file name. Strip the path, e.g using $file = pathInfo($_GET['file'] and then assemble the path by appending some known path with $file['basename']. If you need to provide files from various folders, use path tokens in your request, which you then map to the actual path in your download function.