我正在返回一个带有相应“下载”链接的表格,这些链接由我的数据库中的id分配。用户点击“下载”并获得通知他们将开始文件下载。现在我可以点击“下载”,我下载的文件不是所需的文件,它是PHP页面的回声。强制使用PHP下载文件,标题
下面是当前的代码:
Profile.php
<?php if (isset($_POST['query']))
{
require_once ('../mysqli_connect.php'); //Connect to the db
// Make the query
$genre = $_POST['select_genre'];
$length = $_POST['select_length'];
$upviews = "UPDATE upload
SET views = views + 1
WHERE genre = '$genre' AND length = '$length'";
$runviewupdate = mysqli_query ($dbc, $upviews);
$q = "SELECT upload_id, title, genre, length, created
FROM upload
WHERE genre = '$genre' AND length = '$length'
ORDER BY created DESC, title DESC";
$r = mysqli_query ($dbc, $q); // Run the query
if($r)
{
// If it ran okay, display the records
echo '<table align="center"
cellspacing="3" cellpadding="3"
width="75%">
<tr><td align="left"><b>Title</b></td>
<td align="left"><b>Genre</b></td>
<td align="left"><b>Pages</b></td>
<td align="left"><b>Submitted</b></td>
<td align="left"><b>Download</b></td>';
// Fetch and print all the records:
while ($row = mysqli_fetch_array($r,MYSQLI_ASSOC))
{
echo '<tr><td align="left">' .
$row['title'] . '</td><td align="left">'
. $row['genre'] . '</td><td align="left">'
. $row['length'] . '</td><td align="left">'
. $row['created'] . '</td><td align="left">'
//. $row['views'] . '</td><td align="left">'
. "<a href='newpub_profile.php?id={$row['upload_id']}'>Download</a></td>" . '</td></tr>';
}
echo '</table>'; // Close the table
mysqli_free_result ($r); // Free up the resources
}
else // If it did not run okay
{
// Public Message:
echo '<p class="error">Your submissions could not be retrieved. We
apologize for any inconvenience.</p>';
// Debugging message:
echo '<p>' . mysqli_error($dbc) . '<br /><br />Query: ' . $q . '</p>';
} // End of if ($r) IF.
}
//END DOWNLOAD HANDLER ******************************************************
mysqli_close($dbc); // Close the database connection
// Make sure an ID was passed DOWNLOAD HANDLER *******
if(isset($_GET['id'])) {
// Get the ID
$id = intval($_GET['id']); //var_dump($id);
require_once ('../mysqli_connect.php'); //Connect to the db
// Fetch the file information
$downloadq = "
SELECT `file_type`, `size`, `title`, 'content', 'upload_id'
FROM `upload`
WHERE `upload_id` =".$id;
$result = mysqli_query ($dbc, $downloadq); // Run the query
if($result) {
// Make sure the result is valid
if (mysqli_num_rows($result) > 0) {
// Get the row
$row = mysqli_fetch_assoc($result);
//var_dump($row);
$place = './uploads/'.$_SESSION_['email'].'/';
$thefile = $place.$row['title'];
require('./download.php');
filedownload();
// Print headers
// header("Content-Type: application/msword");
// header("Content-Length: ". $row['size']);
// header("Content-Disposition: attachment; filename=".$row['title']);
// header("Content-Transfer-Encoding: binary");
// readfile($thefile);
// Print data
//echo (stripslashes($row['content']));
exit;
}
else {
echo 'Error! No such ID.';
}
// Free the mysqli resources
mysqli_free_result($result);
}
else {
echo "Error! Query failed: <pre>{$dbc->error}</pre>";
}
mysqli_close($dbc);
}
?>
的download.php
<?PHP
function filedownload()
{
header("Content-Type: application/msword");
header("Content-Length: ". $row['size']);
header("Content-Disposition: attachment; filename=".$row['title']);
header("Content-Transfer-Encoding: binary");
readfile($thefile, 1);
}
?>
“下载”,从表链接是否正确对应的ID文件在数据库中。点击“下载”下载一个名为profile.php的文件,并包含我的php和html标记。在此先感谢,这让我难住。
尝试在你的filedownload函数中回显$ thefile,看看它是否有正确的文件名,尝试传入文件名和$ row数组,而不是依赖全局变量 – wgcrouch 2012-08-12 20:54:29
,然后再对此代码执行任何其他操作, [SQL注入攻击](http://bobby-tables.com)并修复您的代码,然后服务器获取pwn3d。 – 2012-08-12 20:55:11
是的,我会用绑定参数 – V1GG3N 2012-08-12 21:27:20