dloading php code instead of file

[Marc]

Hello
I have a website where I can upload a file via a form. The uploaded
file is stored in a MySQL database. When dloading te file I get a save
as... dialog box, letting me save the file. But when it is dloaded and
I open it, it contains te HTML code of the file displayed...
Wordt thin g is - it _used_ to work so the code is OK - only some
little thing changed. Maybe the header part???

Thanks.

Here is the code:

function downLoad_files( ) {
global $HTTP_GET_VARS, $connection;
$nodelist = array();
// Pull file meta-data
$SQL = "select * from filemetadata where id = '" .
$HTTP_GET_VARS[ID]."'";
if (!$result = mysql_query($SQ L, $connection))
die("Failure to retrieve file metadata:L ".$php_erro r);

if (mysql_num_rows ($result ) != 1)
die("Not a valid file id!");

$FileObj = mysql_fetch_arr ay($result);

// Pull the list of file inodes
$SQL = "SELECT id FROM filedata WHERE
Masterid='".$HT TP_GET_VARS[ID]."' ORDER BY id";

if (!$result = mysql_query($SQ L, $connection))
die("Failure to retrieve list of file inodes");

while ($CUR = mysql_fetch_obj ect($result))
$nodelist[] = $CUR->id;

ob_end_clean();
ob_start();

// Send down the header to the client
Header ( "Content-Type: ".$FileObj[Datatype]);
Header ( "Content-Length: ".$FileObj[Size]);
Header ( "Content-Disposition: attachment;
filename=".$Fil eObj[Name]);

// Loop thru and stream the nodes 1 by 1
for ($i = 0 ; $i < count($nodelist ) ; $i++) {
$SQL = "select FileData from filedata where id =
'".$nodelist[$i]."'";

if (!$result= mysql_query($SQ L, $connection))
die("Failure to retrieve file node data");

$DataObj = mysql_fetch_obj ect($result);
echo $DataObj->Filedata;
}
}

[Gary Petersen]

Re: dloading php code instead of file

A horsie named Marc demonstrated surprising intelligence and its ability
to use morse code on Tue, 09 Sep 2003 19:27:18 -0500 when it tapped
<acad69df.03090 91627.738946b8@ posting.google. com> with its hoof:
[color=blue]
> Hello
> I have a website where I can upload a file via a form. The uploaded file
> is stored in a MySQL database. When dloading te file I get a save as...
> dialog box, letting me save the file. But when it is dloaded and I open
> it, it contains te HTML code of the file displayed... Wordt thin g is -
> it _used_ to work so the code is OK - only some little thing changed.
> Maybe the header part???
>
> Thanks.
>
> Here is the code:
>
> function downLoad_files( ) {
> global $HTTP_GET_VARS, $connection;
> $nodelist = array();
> // Pull file meta-data
> $SQL = "select * from filemetadata where id = '" .
> $HTTP_GET_VARS[ID]."'";[/color]

sql injection opportunity
[color=blue]
> if (!$result = mysql_query($SQ L, $connection))
> die("Failure to retrieve file metadata:L ".$php_erro r);
>
> if (mysql_num_rows ($result ) != 1)
> die("Not a valid file id!");
>
> $FileObj = mysql_fetch_arr ay($result);
>
> // Pull the list of file inodes
> $SQL = "SELECT id FROM filedata WHERE
> Masterid='".$HT TP_GET_VARS[ID]."' ORDER BY id";[/color]

sql injection opportunity
[color=blue]
>
> if (!$result = mysql_query($SQ L, $connection))
> die("Failure to retrieve list of file inodes");
>
> while ($CUR = mysql_fetch_obj ect($result))
> $nodelist[] = $CUR->id;
>
> ob_end_clean();
> ob_start();
>
> // Send down the header to the client
> Header ( "Content-Type: ".$FileObj[Datatype]);
> Header ( "Content-Length: ".$FileObj[Size]);
> Header ( "Content-Disposition: attachment; filename=".$Fil eObj[Name]);
>
> // Loop thru and stream the nodes 1 by 1 for ($i = 0 ; $i <
> count($nodelist ) ; $i++) {
> $SQL = "select FileData from filedata where id =
> '".$nodelist[$i]."'";
>
> if (!$result= mysql_query($SQ L, $connection))
> die("Failure to retrieve file node data");
>
> $DataObj = mysql_fetch_obj ect($result);
> echo $DataObj->Filedata;
> }
> }
> }[/color]

Sorry, I can't see why it does not work. If all of the
chunks of the file refered to by $DataObj->Filedata are
from a PHP file, then the PHP file should be sent to
the browser.

Are you sure about what is in the database? Maybe the
PHP scripts were accidentally converted into HTML
at some earlier point in time.

If you suck the PHP scripts from another server using HTTP,
and insert them into a database, the HTML code is what
will be inserted.