note 46525 added to function.header

I realized that a download script easily could be made to download the whole server in clear code. That is, all your jewels revealed. To avoid this, use a directory where only your downloadable files resides and second, strip the URL from everything that can be used as evil code. Evil code coould look like this: download.php?dl=../../index.php or download.php?dl=../../password.txt The below example protects you fairly well from these types of attacks. $dir = $_SERVER['DOCUMENT_ROOT'].'/download/'; $file = $dir.basename($_REQUEST['dl']); if (isset($_REQUEST['dl']) && file_exists($file) ) { header('Content-type: application/force-download'); header('Content-Transfer-Encoding: Binary'); header('Content-length: '.filesize($file)); header('Content-disposition: attachment; filename='.basename($file)); readfile($file); } else { echo 'No file with this name for download.'; } ---- Manual Page -- http://www.php.net/manual/en/function.header.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+46525 Delete -- http://master.php.net/manage/user-notes.php?action=delete+46525&report=yes Reason: bad code -- http://master.php.net/manage/user-notes.php?action=delete+46525&report=yes&reason=bad+code Reason: spam -- http://master.php.net/manage/user-notes.php?action=delete+46525&report=yes&reason=spam Reason: useless example -- http://master.php.net/manage/user-notes.php?action=delete+46525&report=yes&reason=useless+example Reason: contains commercial links -- http://master.php.net/manage/user-notes.php?action=delete+46525&report=yes&reason=contains+commercial+links Reason: useless note -- http://master.php.net/manage/user-notes.php?action=delete+46525&report=yes&reason=useless+note Reject -- http://master.php.net/manage/user-notes.php?action=reject+46525&report=yes Search -- http://master.php.net/manage/user-notes.php