2012-08-12 91 views
1

我正在返回一个带有相应“下载”链接的表格,这些链接由我的数据库中的id分配。用户点击“下载”并获得通知他们将开始文件下载。现在我可以点击“下载”,我下载的文件不是所需的文件,它是PHP页面的回声。强制使用PHP下载文件,标题

下面是当前的代码:

Profile.php

<?php if (isset($_POST['query'])) 
    { 
    require_once ('../mysqli_connect.php'); //Connect to the db 

    // Make the query 
    $genre = $_POST['select_genre']; 
    $length = $_POST['select_length']; 

    $upviews = "UPDATE upload 
       SET views = views + 1 
       WHERE genre = '$genre' AND length = '$length'"; 
    $runviewupdate = mysqli_query ($dbc, $upviews); 


    $q = "SELECT upload_id, title, genre, length, created 
     FROM upload 
     WHERE genre = '$genre' AND length = '$length' 
     ORDER BY created DESC, title DESC"; 


    $r = mysqli_query ($dbc, $q); // Run the query 

    if($r) 
    { 
     // If it ran okay, display the records 
     echo '<table align="center" 
      cellspacing="3" cellpadding="3" 
      width="75%"> 
      <tr><td align="left"><b>Title</b></td> 
      <td align="left"><b>Genre</b></td> 
      <td align="left"><b>Pages</b></td> 
      <td align="left"><b>Submitted</b></td> 
      <td align="left"><b>Download</b></td>'; 

     // Fetch and print all the records: 

     while ($row = mysqli_fetch_array($r,MYSQLI_ASSOC)) 
     { 
      echo '<tr><td align="left">' . 
      $row['title'] . '</td><td align="left">' 
      . $row['genre'] . '</td><td align="left">' 
      . $row['length'] . '</td><td align="left">' 
      . $row['created'] . '</td><td align="left">' 
      //. $row['views'] . '</td><td align="left">' 
      . "<a href='newpub_profile.php?id={$row['upload_id']}'>Download</a></td>" . '</td></tr>'; 
     } 
     echo '</table>'; // Close the table 

     mysqli_free_result ($r); // Free up the resources 
    } 
    else // If it did not run okay 
    { 
     // Public Message: 

     echo '<p class="error">Your submissions could not be retrieved. We 
      apologize for any inconvenience.</p>'; 

     // Debugging message: 

     echo '<p>' . mysqli_error($dbc) . '<br /><br />Query: ' . $q . '</p>'; 

    } // End of if ($r) IF. 



} 

//END DOWNLOAD HANDLER ****************************************************** 


    mysqli_close($dbc); // Close the database connection 




        // Make sure an ID was passed DOWNLOAD HANDLER ******* 
if(isset($_GET['id'])) { 
// Get the ID 
    $id = intval($_GET['id']); //var_dump($id); 

    require_once ('../mysqli_connect.php'); //Connect to the db 

// Fetch the file information 
     $downloadq = " 
      SELECT `file_type`, `size`, `title`, 'content', 'upload_id' 
      FROM `upload` 
      WHERE `upload_id` =".$id; 
     $result = mysqli_query ($dbc, $downloadq); // Run the query 


     if($result) { 
      // Make sure the result is valid 
      if (mysqli_num_rows($result) > 0) { 
      // Get the row 
       $row = mysqli_fetch_assoc($result); 
       //var_dump($row); 

       $place = './uploads/'.$_SESSION_['email'].'/'; 
       $thefile = $place.$row['title']; 

       require('./download.php'); 
       filedownload(); 


       // Print headers 
       // header("Content-Type: application/msword"); 
       // header("Content-Length: ". $row['size']); 
       // header("Content-Disposition: attachment; filename=".$row['title']); 
       // header("Content-Transfer-Encoding: binary"); 
       // readfile($thefile); 



       // Print data 
       //echo (stripslashes($row['content'])); 



       exit; 


      } 
      else { 
       echo 'Error! No such ID.'; 
      } 

      // Free the mysqli resources 
      mysqli_free_result($result); 
     } 
     else { 
      echo "Error! Query failed: <pre>{$dbc->error}</pre>"; 
     } 
     mysqli_close($dbc); 



    } 

        ?> 

的download.php

<?PHP 

function filedownload() 
{ 
       header("Content-Type: application/msword"); 
       header("Content-Length: ". $row['size']); 
       header("Content-Disposition: attachment; filename=".$row['title']); 
       header("Content-Transfer-Encoding: binary"); 
       readfile($thefile, 1); 

} 
       ?> 

“下载”,从表链接是否正确对应的ID文件在数据库中。点击“下载”下载一个名为profile.php的文件,并包含我的php和html标记。在此先感谢,这让我难住。

+0

尝试在你的filedownload函数中回显$ thefile,看看它是否有正确的文件名,尝试传入文件名和$ row数组,而不是依赖全局变量 – wgcrouch 2012-08-12 20:54:29

+3

,然后再对此代码执行任何其他操作, [SQL注入攻击](http://bobby-tables.com)并修复您的代码,然后服务器获取pwn3d。 – 2012-08-12 20:55:11

+0

是的,我会用绑定参数 – V1GG3N 2012-08-12 21:27:20

回答

1

尝试把

global $row, $thefile; 

为您filedownload()内的第一线 - 功能。我注意到你正试图使用​​这个函数之外的变量。

+0

我试过了。结果是我现在下载一个正确标题的文件,因为它对应于我的数据库。但是,该文件的内容是来自我的个人资料页面的html标记,包含文本框和标题。 – V1GG3N 2012-08-12 21:30:23

+1

刚刚注意到它:您的下载链接引用了一个名为'newpub_profile.php'的文件。这是上面的代码的底部? – 2012-08-13 07:49:08

+0

忽略了那个链接。 newpub_profile.php是包含上面第一个代码块的文件的名称,我将其称为“profile.php”。这个链接应该直接指向download.php吗? – V1GG3N 2012-08-13 13:01:35