What potential pitfalls or errors could occur when using the provided PHP script for file downloads?

One potential pitfall when using the provided PHP script for file downloads is that it does not handle file paths securely, which could lead to directory traversal attacks. To solve this issue, it is important to sanitize the file path input to prevent malicious users from accessing sensitive files on the server. 

// Sanitize the file path input to prevent directory traversal attacks
$filename = basename($_GET['file']);
$filepath = 'path/to/files/' . $filename;

// Check if the file exists before initiating the download
if (file_exists($filepath)) {
    // Set appropriate headers for the file download
    header('Content-Description: File Transfer');
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename="' . $filename . '"');
    header('Expires: 0');
    header('Cache-Control: must-revalidate');
    header('Pragma: public');
    header('Content-Length: ' . filesize($filepath));
    
    // Read the file and output its contents
    readfile($filepath);
    exit;
} else {
    echo 'File not found.';
}

Keywords

file downloads PHP script errors security vulnerabilities file handling

Related Questions