How to make a PHP download script without disclosing the location of the files

Posted on September 20, 2008, Filled under PHP, Bookmark it

Thanks for visiting our website! We regularly publish posts like this one. If you are interested in receiving the latest updates as soon as they are posted, please consider subscribing to the RSS feed or to our e-mail newsletter.

Did you ever want to hide the path where your downloadable files are located? If so, then you came in the right place. In this tutorial we will learn how to create download links which do not disclose the actual location of the files.

We will begin creating the configuration file. First, you will decide whether the file downloaded will have the original or the alias name.

config.php

<?php
/*
Show alias name or the original name to the user?
TRUE = original name, FALSE = alias
*/

define("SHOW_ORIGINAL_FILE_NAME", true);

Then, we will build the array that will contain the downloadable files. The key of the array is used as an ID to download the real file.

/*
This is the list with the files.
'alias' => 'realfile'

Example: www.yoursite.com/download.php?file=images_archive

Make sure that each key is unique
*/
$aliases = array('images_archive'  => 'images_archiver_08-19-2008.zip',
                              'document'  => 'document.txt',
		                     'logo'   => 'bit-logo.jpg');

Now let’s set the path to the downloads folder:

define("PATH_TO_DOWNLOADS", '/home/your_site/public_html/3d99267acce487b6a26e7ad10c5b51a8/');
?>

Let’s create a sample html page:

index.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
 <HEAD>
  <TITLE>Download Script from BitRepository.com</TITLE>

  <META NAME="Author" CONTENT="BitRepository.com">

  <META NAME="Keywords" CONTENT="download, php, files">
  <META NAME="Description" CONTENT="A PHP Download Script">

 </HEAD>

 <BODY>
  <fieldset><legend>Downloads</legend>
  <ol>
    <li><a href="download.php?id=images_archive">Download &gt; Images Archive</a></li>

    <li><a href="download.php?id=document">Download &gt; Document</a></li>
	<li><a href="download.php?id=picture">Download &gt; Picture</a></li>

  </ol>
  </fieldset>
 </BODY>
</HTML>

Let’s create the file download.php, which will get the ID and download the file associated with it.

download.php

Let’s include config.php and set the $id variable.

<?php
// hide notice errors
error_reporting (E_ALL ^ E_NOTICE);

// include the config file
include 'config.php';

$id = ($_GET['id']) ? $_GET['id'] : '';

$id is not null? Continue and check if the $id key is in our array. We will check that using the array_key_exists() function. After that will be obtain the file’s extension.

if($id) // Continue only if an id is requested
{
  if(array_key_exists($id, $aliases)) // Continue if the requested value exists as a key in the array
  {
	# get file extension
	$ext = strrchr($aliases[$id], '.');

The downloaded filename will be determine upon the value of the constant SHOW_ORIGINAL_FILE_NAME (true = actual file name, false = alias file name).

$filename = (SHOW_ORIGINAL_FILE_NAME) ? $aliases[$id] : $id.$ext;

We need to setup the full path to our file and also determine the file’s length. After that the right headers should be sent to the browser & eventually use the readfile() function which reads the file and writes it to the output buffer.

$file = PATH_TO_FILE.$aliases[$id];

$Length = filesize($file);

	header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
    header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); // Date in the past

	header("Content-Description: File Transfer");

    header("Content-Type: application/save");

    header("Content-Length: ".$Length);
    header("Content-Disposition: attachment; filename=".$filename);
    header("Content-Transfer-Encoding: binary");

	readfile($file);
  }
}
?>

PS: If you have any suggestions or comments regarding this tutorial, please post them!