What are the best practices for managing file downloads using PHP on a web server?

When managing file downloads using PHP on a web server, it is important to ensure proper security measures are in place to prevent unauthorized access to files and to handle large file downloads efficiently. One common best practice is to use PHP headers to set the content type and disposition of the file being downloaded, as well as to stream the file to the client rather than loading it all into memory at once. 

<?php
// Set the file path and name
$file = 'path/to/file.pdf';

// Check if the file exists
if (file_exists($file)) {
    // Set headers for file download
    header('Content-Description: File Transfer');
    header('Content-Type: application/pdf');
    header('Content-Disposition: attachment; filename="' . basename($file) . '"');
    header('Content-Length: ' . filesize($file));
    header('Cache-Control: private');
    
    // Flush the output buffer
    ob_clean();
    flush();
    
    // Stream the file to the client
    readfile($file);
    exit;
} else {
    // File not found
    http_response_code(404);
    echo 'File not found.';
}
?>

Keywords

file downloads PHP web server headers content-disposition

Related Questions