Serving files through PHP

UPDATE:
- I’d like to thank a friend who detected this bug:
Microsoft Windows users, please change the following line:
if (realpath($allowedfilepath).”/$file” …
to,
if (realpath($allowedfilepath).”\\$file” …
 

Serving files through PHP is basically needed in two cases:
1) When you want to count the number of times it has been downloaded.
2) When you don’t want to give direct access to the file from your server. (Hiding or protecting file path)

-Being able to serve files through PHP can also be useful when you want only specific users to download the files in your server, for example: Only registered users, or users who pays for the file, like online PDF books.
-You can also use it to ban or allow specific files to your users.
It gives you full control over transferring of files in your server.

Here is a code snippet to serve a file using php script.

Step1: Copy the following code and save it as, getfile.php:
<?php /* *Snippet name: FCS File path protector v1.0 for PHP - Serving files through PHP *Version: 1.0 *Author: guru *Visit http://freecodesnippet.com for updates, and critical bug fixes. */ session_cache_limiter('none'); //Use before session_start() session_start(); $allowedfilepath="files/"; $file =  stripslashes($_GET['file']); //Make sure the 'file' paramater is not null, and the file exists. if (isset($_GET['file']) && file_exists($allowedfilepath.$file) && is_readable($allowedfilepath.$file)){  /*   Do not allow files outside the allowed directory to be downloaded.   WARNING: Do not remove the following line if (realpath($allowedfilepath)."/$file"==realpath ...      */    //If you remove this line, you're in big trouble. (All files in your server will be accessible)  if (realpath($allowedfilepath)."/$file"==realpath($allowedfilepath.$file)){   _getfile($allowedfilepath, $file);  } else {     /*   You can set it to HTTP/1.0 404 Not Found if you don't   want to show forbidden message.   */   header("HTTP/1.0 403 Forbidden");    } } else {  header("HTTP/1.0 404 Not Found");  header("Status: 404 Not Found"); } function _getfile($_path, $_file){  //Make sure the file is not cached by the browser.     header ('Cache-Control: no-store, no-cache, must-revalidate');     header ('Cache-Control: pre-check=0, post-check=0, max-age=0');     header ('Pragma: no-cache');         header('Content-Description: File Transfer');     header('Content-Type: application/octet-stream');     header('Content-Length: ' . filesize($_path.$_file));     header('Content-Disposition: attachment; filename=' . basename($_file));     //Reads the file and writes it to output.     @readfile($_path.$_file);  } ?>

To use the code:
1) Make a subfolder inside inside your home directory named ‘files’.
2) Put all your files that you want to server through php, inside that folder.
3) Copy and save the program as ‘getfile.php’ on your home directory.
4) Restrict direct access to all the files inside the sub-folder (files) you just created.

Restricting direct access your files:
If you do not restrict direct access to the files you wan to server through your PHP program, people can directly access/download the file like:
http://your-site.com/files/book1.pdf

Step2: To prevent this, make a file named ‘.htaccess’ inside the ‘files’ directory and write following text on that file:
#deny all access
deny from all
IndexIgnore *

Now, your files won’t be accessible directly like mentioned above, users will only be able to access the file like:
http://your-site.com/getfile.php?file=book1.pdf

That is, if you have allowed this on getfile.php.

You can also make a database to store number of times a particular file has been downloaded.
If you want a code to do this, please comment below and let me know.

!Cheers