Re: Re: IE download problem

* Thus wrote pete M (pmorgan@ukds.net): > thsi si a nighmare area..... and loast days on same problem Its a nightmare area cause so many things can go wrong with your script. > > This works for me.. hope it does for you > > $file = $_GET['file']; > $path = '/www/cgi-bin/docu/personal/'.$file; very insecure, no de-tainting of the string or ensuring the file isn't accessing bad things ie: ?file=../../../../etc/passwd > //force download dialog > header("Content-type: application/octet-stream\n"); New lines are ignore and stripped so its unneeded, besides that http headers should have \r\n. > header("Content-disposition: attachment; filename=\"$file\"\n"); > header("Content-transfer-encoding: binary\n"); > header("Content-length: " . filesize($path) . "\n"); $path was never checked for existance, you'll confuse the client by sending a wrong content-length. > > //send file contents > $fp=fopen($path, "r"); > fpassthru($fp); Again $path wasn't checked to see if it was a valid file. Curt -- "My PHP key is worn out" PHP List stats since 1997: http://zirzow.dyndns.org/html/mlists/