What potential pitfalls should be considered when modifying the Content-Disposition header for file downloads in PHP?

When modifying the Content-Disposition header for file downloads in PHP, potential pitfalls to consider include ensuring that the filename is properly sanitized to prevent directory traversal attacks and that special characters are properly encoded to avoid potential security vulnerabilities or file naming issues.

// Set the filename for download with proper sanitization and encoding
$filename = "example_file.pdf";
$encoded_filename = rawurlencode($filename);

// Set the Content-Disposition header with the sanitized filename
header("Content-Disposition: attachment; filename=\"" . $encoded_filename . "\"");