note 68659 added to function.header

Thanks for everyones help with this guy's, I am using session_start and need to have files available for users to download whilst ensuring that only users who are logged in can download the files. The other priority is that I needed to make sure that users cannot type something like download.php?dl=index.php or ../index.php I have taken the best points from everything above and now use: <?php include "config.php"; \\ config.php contains the session information header('Cache-Control: public'); if ( $_SESSION["logged_in"] == 1){ $dir="downloadfolder/"; $file=$dir.$_GET["dl"]; if (isset($_REQUEST['dl']) && file_exists($file) ) { header('Pragma: anytextexeptno-cache', true); header('Content-type: application/force-download'); header('Content-Transfer-Encoding: Binary'); header('Content-length: '.filesize($file)); header('Content-disposition: attachment; filename='.basename($file)); readfile($file); } else { echo 'No file with this name for download.'; } }else{ echo "You are not logged in<br>"; } ?> ---- Server IP: 203.220.0.234 Probable Submitter: 203.134.1.70 ---- X-Spam-Status: No, hits=3.3 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER, HTML_MESSAGE autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.header.php Edit -- https://master.php.net/note/edit/68659 Del: integrated -- https://master.php.net/note/delete/68659/integrated Del: useless -- https://master.php.net/note/delete/68659/useless Del: bad code -- https://master.php.net/note/delete/68659/bad+code Del: spam -- https://master.php.net/note/delete/68659/spam Del: non-english -- https://master.php.net/note/delete/68659/non-english Del: in docs -- https://master.php.net/note/delete/68659/in+docs Del: other reasons-- https://master.php.net/note/delete/68659 Reject -- https://master.php.net/note/reject/68659 Search -- https://master.php.net/manage/user-notes.php