How can the use of Content-Disposition header in PHP affect file downloads, and what best practices should be followed?

When using the Content-Disposition header in PHP to force file downloads, it's important to properly set the header to avoid potential security risks such as file path disclosure or content type mismatch. To ensure safe file downloads, the best practice is to set the header with a safe filename and the appropriate content type. 

<?php
// Set the file path
$file = 'path/to/file.pdf';

// Set the appropriate content type
header('Content-Type: application/pdf');

// Set the Content-Disposition header with a safe filename
header('Content-Disposition: attachment; filename="downloaded_file.pdf"');

// Output the file
readfile($file);

Keywords

Content-Disposition header file downloads PHP best practices header manipulation

Related Questions