Question

I am returning a table with corresponding “download” links, which are assigned by id’s from my database. User clicks on “download” and gets a notification that they will begin a file download. Right now I can click on “download” and the file I download is not the desired file, it is an echo of the php page.

Here is the current code:

Profile.php

   <?php if (isset($_POST['query']))
   {
   require_once ('../mysqli_connect.php'); //Connect to the db

    // Make the query
   $genre = $_POST['select_genre'];
   $length = $_POST['select_length'];

    $upviews = "UPDATE upload
                SET views = views + 1
                WHERE genre = '$genre' AND length = '$length'";
    $runviewupdate = mysqli_query ($dbc, $upviews);


    $q = "SELECT upload_id, title, genre, length, created
        FROM upload
        WHERE genre = '$genre' AND length = '$length'
        ORDER BY created DESC, title DESC";


    $r = mysqli_query ($dbc, $q); // Run the query

    if($r)
    {
        // If it ran okay, display the records
        echo '<table align="center"
            cellspacing="3" cellpadding="3"
            width="75%">
           <tr><td align="left"><b>Title</b></td>
           <td align="left"><b>Genre</b></td>
           <td align="left"><b>Pages</b></td>
           <td align="left"><b>Submitted</b></td>
           <td align="left"><b>Download</b></td>';

        // Fetch and print all the records:

        while ($row = mysqli_fetch_array($r,MYSQLI_ASSOC))
        {
            echo '<tr><td align="left">' .
            $row['title'] . '</td><td align="left">'
            . $row['genre'] . '</td><td align="left">'
            . $row['length'] . '</td><td align="left">'
            . $row['created'] . '</td><td align="left">'
            //. $row['views'] . '</td><td align="left">'
            . "<a href='newpub_profile.php?id={$row['upload_id']}'>Download</a></td>" . '</td></tr>';
        }
        echo '</table>'; // Close the table

        mysqli_free_result ($r); // Free up the resources
    }
    else // If it did not run okay
    {
        // Public Message:

        echo '<p class="error">Your submissions could not be retrieved.  We
            apologize for any inconvenience.</p>';

        // Debugging message:

        echo '<p>' . mysqli_error($dbc) . '<br /><br />Query: ' . $q . '</p>';

    } // End of if ($r) IF.



}

//END DOWNLOAD HANDLER ******************************************************


    mysqli_close($dbc); // Close the database connection




                    // Make sure an ID was passed DOWNLOAD HANDLER *******
if(isset($_GET['id'])) {
// Get the ID
    $id = intval($_GET['id']); //var_dump($id);

    require_once ('../mysqli_connect.php'); //Connect to the db

// Fetch the file information
        $downloadq = "
            SELECT `file_type`, `size`, `title`, 'content', 'upload_id'
            FROM `upload`
            WHERE `upload_id` =".$id;
        $result = mysqli_query ($dbc, $downloadq); // Run the query


        if($result) {
            // Make sure the result is valid
            if (mysqli_num_rows($result) > 0) {
            // Get the row
                $row = mysqli_fetch_assoc($result);
                //var_dump($row);

                $place = './uploads/'.$_SESSION_['email'].'/';
                $thefile = $place.$row['title'];

                require('./download.php');
                filedownload();


                // Print headers
              // header("Content-Type: application/msword");
              // header("Content-Length: ". $row['size']);
              // header("Content-Disposition: attachment; filename=".$row['title']);
              // header("Content-Transfer-Encoding: binary");
              // readfile($thefile);



                // Print data
                //echo (stripslashes($row['content']));



                exit;


            }
            else {
                echo 'Error! No such ID.';
            }

            // Free the mysqli resources
            mysqli_free_result($result);
        }
        else {
            echo "Error! Query failed: <pre>{$dbc->error}</pre>";
        }
        mysqli_close($dbc);



    }

                    ?>

download.php

<?PHP

function filedownload()
{
               header("Content-Type: application/msword");
               header("Content-Length: ". $row['size']);
               header("Content-Disposition: attachment; filename=".$row['title']);
               header("Content-Transfer-Encoding: binary");
               readfile($thefile, 1);

}
               ?>

The “download” link from the table corresponds correctly to the id for the file in the database. Clicking “download” downloads a file called profile.php and contains my php and html markup. Thanks in advance, this has me stumped.

Answer 1

Try putting

global $row, $thefile;

as a first line inside your filedownload()-function. I notice you’re trying to use variables from outside this function.