Are there any security considerations to keep in mind when directly offering a file for download in PHP?

When directly offering a file for download in PHP, it is important to consider security risks such as unauthorized access to sensitive files or execution of malicious scripts. To mitigate these risks, it is recommended to store the files outside of the web root directory and use PHP to handle the download process, ensuring proper validation and sanitization of file paths. 

<?php
// Validate and sanitize the file path
$filePath = '/path/to/secure/files/' . $_GET['file'];

if (file_exists($filePath)) {
    // Set appropriate headers for file download
    header('Content-Description: File Transfer');
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename="' . basename($filePath) . '"');
    header('Expires: 0');
    header('Cache-Control: must-revalidate');
    header('Pragma: public');
    header('Content-Length: ' . filesize($filePath));
    
    // Read the file and output it to the browser
    readfile($filePath);
    exit;
} else {
    // Handle file not found error
    echo 'File not found.';
}
?>

Keywords

file download security considerations PHP file permissions content type

Related Questions