First, an explanation of my changes.
1. Add a doctype
You need a doctype in your documents to tell the web browser what type of document you are giving them. This document looks like HTML 4.0 Transitional, so you must include this doctype. You may find a list of doctypes here. They must be before the <html> tag.
2. escape your database inputs.
Any user-derived data must go through mysql_real_escape_string to avoid SQL injections.
PHP Code:
<?
if(isset($_GET['id']))
{
include 'config.php';
include 'opendb.php';
$id = mysql_real_escape_string($_GET['id']);
$query = "SELECT name, type, size, content FROM upload WHERE id = '$id'";
$result = mysql_query($query) or die('Error, query failed');
list($name, $type, $size, $content) = mysql_fetch_array($result);
header("Content-Disposition: attachment; filename=$name");
header("Content-length: $size");
header("Content-type: $type");
echo $content;
include 'closedb.php';
exit;
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Download File From MySQL</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body>
<div id="container">
<?
include 'config.php';
include 'opendb.php';
$query = "SELECT id, name FROM upload";
$result = mysql_query($query) or die('Error, query failed');
if(mysql_num_rows($result) == 0)
{
echo "<p>Database is empty</p>";
}
else
{
?>
<table border="1">
<tr><td>Name</td><td>Preview</td><td>Download</td></tr>
<tr>
<?
$rows = 0;
while(list($id, $name) = mysql_fetch_array($result))
{
list($id,$name) = $arr;
$rows++;
echo (($rows % 4) == 0)?"</tr>":"";
printf("<tr><td>%s</td><td><img src=\"%s\" height=\"150\" width=\"150\" /></td><td><a href=\"download.php?id=%s\">Download</a></td>\n",
$name,
"download.php?id=".$id,
$id
);
}
?>
</tr>
</table>
</div>
<?
}
include 'closedb.php';
?>
</body>
</html>
Bookmarks