USING PHP TO MANAGE FILES 2. Remove any default code created by your script editor, and insert the following code: | USING PHP TO MANAGE FILES 2. Remove any default code created by your script editor and insert the following code php define error page error http localhost phpsols define the path to the download folder filepath C xampp htdocs phpsols images getfile NULL block any attempt to explore the filesystem if isset _GET file basename _GET file _GET file getfile _GET file else header Location error exit if getfile path filepath . getfile check that it exists and is readable if file_exists path is_readable path get the file s size and send the appropriate headers size filesize path header Content-Type application octet-stream header Content-Length . size header Content-Disposition attachment filename . getfile header Content-Transfer-Encoding binary open the file in read-only mode suppress error messages if the file can t be opened file @fopen path r if file stream the file and exit the script when complete fpassthru file exit else header Location error else header Location error The only two lines that you need to change in this script are highlighted in bold type. The first defines error a variable that contains the URL of your error page. The second line that needs to be changed defines the path to the folder where the download file is stored. The script works by taking the name of the file to be downloaded from a query string appended to the URL and saving it as getfile. Because query strings can be easily tampered with 211 CHAPTER 7 Download from Wow eBook getfile is initially set to NULL. This is an important security measure. If you fail to do this you could give a malicious user access to any file on your server. The opening conditional statement uses basename to make sure that an attacker cannot request a file such as one that stores passwords from another part of your file structure. As explained in Chapter 4 basename extracts the filename component of a path so if basename _GET file is different from _GET file you know there s an attempt
