Secure file download in PHP, deny user without permission

Question

I'm making a website where you can buy files for virtual points, and then download them. I don't want to let users download the files without buying it, so I have to hide them. I put all the files in a folder without permission for anyone except host, the problem is when someone buys a file and wants to download it.

I decided to make a file getter, that will check permissions of user and then print out the file contents. My code so far:

<?php
    require_once('content/requirements.php'); //mysql connections
    secure(1); //disconnect unlogged users

    if (!isset($_GET['id'])) //if no file id provided
        die();

    $fid=mysql_real_escape_string($_GET['id']); //file id

    $query="SELECT * FROM files WHERE user_id = "$_SESSION['user_id']." AND file_id = ".$id;

    $q=mysql_query($query);

    if (mysql_num_rows($q)!=1) //if no permission for file or multipe files returned
        die();

    $file=mysql_fetch_array($q); //file id
    $sub=mysql_fetch_array(mysql_query("SELECT * FROM sub WHERE id = ".$file['file_id'])); //payment id
?>

Now when Im sure the user is authorized to do this, phpScript should write the file contents and send appropiate header to let user download it.

How to read file byte-by-byte and print it and what should i write in header(), to make the file downloadable (so you don't have to copypaste its contents).

Maybe this is not the best way to do this, but it was the best thing I thought of in a while.

Thanx for any help.

Use google. There are millions of explanations about this. – arkascha Nov 19 '12 at 12:48 — arkascha, Nov 19 '12 at 12:48
Try googling for 'SQL injection' while you're there. – symcbean Nov 19 '12 at 12:57 — symcbean, Nov 19 '12 at 12:57

score 9 · Accepted Answer · answered Nov 19 '12 at 12:51

from readfile php doc

if (file_exists($file)) {
    header('Content-Description: File Transfer');
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename='.basename($file));
    header('Content-Transfer-Encoding: binary');
    header('Expires: 0');
    header('Cache-Control: must-revalidate');
    header('Pragma: public');
    header('Content-Length: ' . filesize($file));
    ob_clean();
    flush();
    readfile($file);
    exit;
}

This is not safe script. Site users can download other files too with relative path. — Deepak Dholiyan, Mar 22 '21 at 14:20

score 5 · Answer 2 · answered Nov 19 '12 at 12:51

5

There are many script available on google, Below are few links:

http://www.tutorialchip.com/php-download-file-script

http://www.webinfopedia.com/php-file-download-script.html

answered Nov 19 '12 at 12:51

VibhaJ

2,256
19
31

1

I implemented chip's tutorial, and it work's like charm. Thank you – IberoMedia May 23 '13 at 00:46
1

Hi, I was getting a corrupt zip file, and after picking and pocking I figured out the solution. Again, from tutorialchip class, add ob_start() sometime before the ob_clean to prevent zip file with error "
Notice: ob_clean() [ref.outcontrol]: failed to delete buffer. No buffer to delete in /some/grid/server... on line 413
" – IberoMedia May 23 '13 at 08:26
Found solution: Its not taking absolute path like, "http://example.com/directory/filename.exe" you have to use relative path to your download.php file ie, "directory/filename.exe" should be your dpwnload path.. – Girish Thimmegowda Dec 03 '13 at 05:41
http://www.webinfopedia.com/php-file-download-script.html My sql Error on this site. – Mohammad Arshi May 10 '15 at 07:26

Secure file download in PHP, deny user without permission

2 Answers2

Linked