GET Parameter for downloading files

Question

i'm new at PHP Programming. So I Have a big question:

My Problem is that I will have a button for example:

<a href="/upload_crypt.php?id=370&snrid=123456">PDF Download</a>

I will use this upload_crypt.php file to get my complete link back. This Link must be set as a header request so that the User can not see the full path and the pdf is show to safe by the browser.

In my upload_crypt.php file I have the following code:

<?php
include_once("db.inc.php");
include_once("db_connect.inc.php");

@session_start();

$snrid = $_GET['snrid'];  
$id = $_GET['id'];


$sql_query4 = 'SELECT * FROM web_osc_uploads WHERE Section = "Schaden" AND DocType = "pdf" AND DocDesc = "Kaufbeleg" AND IdentValue = "'.$_GET['snrid'].'" AND ID = "'.$_GET['id'].'"';
                $sql_result4 = mysqli_query($mysql, $sql_query4); 

        $sql_row4 = mysqli_fetch_object($sql_result4);
        $filename = $sql_row4->Filename;
        $Url_string = 'upload/'.$snrid.'/'.$id.'/'.$filename.'';



        if($id != ''){

          if (!file_exists('../upload/'.$snrid.'/'.$id.'/'.$filename)) {

            header('Content-Type: application/pdf');

            // Es wird downloaded.pdf benannt
            header('Content-Disposition: inline; filename='.$filename.'');

            // Die originale PDF Datei heißt original.pdf
            readfile('../upload/'.$snrid.'/'.$id.'/'.$filename);

          }



        }else{} 



?>

Check this https://stackoverflow.com/questions/10997516/how-to-hide-the-actual-download-folder-location — Jacek, Feb 07 '18 at 09:36
@BrianPatterson when I click on PDF Download I will get the uploaded PDF File from This ID — phil, Feb 07 '18 at 09:49
is sql returning correct data? is it get-ing the id ? need filter_input() btw. echo the path, is it correct? — Brian Patterson, Feb 07 '18 at 12:19
The code above is vulnerable to sql injection and a potential local file inclusion, also a potential cross-site scripting through malicious file upload as no x-content-type-options is sent. But what is the question? — Gabor Lengyel, Feb 07 '18 at 14:18

GET Parameter for downloading files

0 Answers0