Trying to force a download of an mp3 file with PHP, but it tries to download the php file instead [closed]

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center. Closed 9 years ago.

I am trying to force a download of an MP3 file. on the htm file, I link to the download.php file with:

<a href="download.php?file=someaudiofile.mp3">LINK</a>

contents of download.php

$filename = $_GET['file']  
header("Content-Length: " . filesize($filename));
header('Content-Type: audio/mp3');
header('Content-Disposition: attachment; filename=audiofile.mp3');
readfile($filename);

but the end result, in all 3 major browsers is, would you like to download 'download.php'?

it is trying to download the php file instead of the mp3....I dont get it.

Any ideas?

Thanks in advance.

---

Sorry guys, I should have added the to that, I just implied it. it is there in the code on the site. Also the semi colon is on the live version as well, my fault for not adding it here. It was late and I was kranky because it wasn't working :).

It will only need to download that single file, so I will throw a security catch making sure it matches that exact file n开发者_JAVA技巧ame or stops execution.

What I just don't understand is why the script tries to download the PHP file instead of the Mp3 requested.

---

You need to wrap your PHP code in <?php ... ?>, otherwise it's treated as HTML.

Be warned that your script has a large security flaw. People can specify a filename that looks outside of your download directory and downloads any file on your system. If you don't need folders, the simplest way to block prevent this is to prohibit slashes and backlashes in the filename. For example, you could add this after you define $filename.

if (strstr($filename), "/") || strstr($filename), "\\") {
    die();
}

Your code also contains a syntax error: you forgot to include a semicolon (;) after your first line.