PHP Content-Disposition header: Specialcharacters in the filename

Question

I am trying to download a file with php that has special characters in the file name. Unfortunately these characters are substituted by "_".

The code:

$filename = trim('<>$%&/=?' . '.txt');

header($_SERVER["SERVER_PROTOCOL"] . " 200 OK");
header("Cache-Control: public");
header("Content-Type: application/text");
header("Content-Transfer-Encoding: Binary");
header('Content-Disposition: attachment; '
        . sprintf('filename="%s"; ', urlencode($filename))
        . sprintf("filename*=utf-8''%s", urlencode($filename)));
echo "file contents";
die();

returns a file named

"__$%&_=_.txt"

I have tried different variations with urlencode(), rawurlencode(), mb_convert_string($filename, "UTF-8"). The already present issues Special Characters in Content-Disposition filename, How to encode the filename parameter of Content-Disposition header in HTTP? and PHP: RFC-2231 How to encode UTF-8 String as Content-Disposition filename did not really help me. Do you have any further ideas?

Encoding of the file is UTF-8.

Sprintf() seems not to be the problem:

header("Content-Disposition: attachment; filename*=utf-8''" . rawurlencode($filename));

or

header("Content-Disposition: attachment; filename=\"" . $filename . "\"");

give the same result.

`sprintf()` and the like aren't unicode-aware. they WILL mangle multibyte text. there is no mb_*() equivalent for sprintf either. you'll have to use other means. — Marc B, Jul 04 '16 at 21:41
Thank you for your input. However, sprintf() does not seem to be the problem. header("Content-Disposition: attachment; filename*=utf-8''" . rawurlencode($filename)); or header("Content-Disposition: attachment; filename=\"" . $filename . "\""); give the same result. The filename still is "__$%&_=_.txt". It also tried different variations with mb_convert_encoding() etc. — ToHe, Jul 05 '16 at 20:03
Until I find a better way, it seems the most convenient thing is to actually transliterate. — Glorious Kale, Oct 15 '19 at 16:25

score 0 · Answer 1 · answered Jun 12 '22 at 08:30

I believe, the issue has nothing to do with the encoding of the filename ("Content-Disposition: attachment; filename*=utf-8''" . rawurlencode($filename) option seems correct).

Some characters such as ?, <, > are just not allowed in filenames on particular platforms and replaced with _ by a browser.

Also, you can have both filename and filename* params in Content-Disposition header, using the former as a fallback for client that doesn't support extended filename* param. It can be done seamlessly with content-disposition lib.

PHP Content-Disposition header: Specialcharacters in the filename

1 Answers1