Are there any security concerns to consider when implementing a file download functionality in PHP?

One security concern when implementing file download functionality in PHP is the risk of allowing users to download sensitive files outside of the intended directory. To mitigate this risk, it's important to validate user input and ensure that the file being requested is within a safe directory. Additionally, it's crucial to set appropriate file permissions to prevent unauthorized access to files. 

<?php
$allowedDirectory = '/path/to/safe/directory/';

$requestedFile = $_GET['file'];

if (strpos($requestedFile, '..') !== false || !file_exists($allowedDirectory . $requestedFile)) {
    die('Invalid file request');
}

$file = $allowedDirectory . $requestedFile;

header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="' . basename($file) . '"');
header('Expires: 0');
header('Cache-Control: must-revalidate');
header('Pragma: public');
header('Content-Length: ' . filesize($file));
readfile($file);
exit;
?>

Keywords

file download security concerns PHP vulnerabilities file handling

Related Questions