不显示真实路径的 PHP 脚本会生成扩展名为“.php”的下载


PHP script that does not reveal real path generates download with ".php" extension

一个名为"transfer.php"的文件应该提供一个文件供下载。它提供的不是下载,而是提供了一个与原始文件文件大小相同的".php"文件。我弄错了标题吗?

谢谢!

<?php
session_start();
$path = $_SESSION['myvar'];
$mm_type = "application/octet-stream";
header("Pragma: public");
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Cache-Control: public");
header("Content-Description: File Transfer");
header("Content-Type: ".$mm_type);
header("Content-Length: ".(string)(filesize($path)) );
header("Content-Disposition: attachment; filename=".basename($path).'"');
header("Content-Transfer-Encoding: binary'n");
readfile($path); // outputs the content of the file
exit();

虽然我最初建议删除处置标题中的尾随未配对引号..

文件名应括在引号中(感谢 Wrikken!在发布的代码中缺少第一个引号。对第一个字符串使用 ' 会使配对(或缺少)更加清晰:

header('Content-Disposition: attachment; filename="' . basename($path) . '"');