John Davidson

Message:

I have a database table which stores the document file name and on the local pc i have a folder named as uploads which stores the actual files the user uploads.

The way i upload files are as follows,

$filename = $_FILES['attachment']['name'];

    

    // destination of the file on the server

    $destination = 'uploads/' . $filename;

    

    // get the file extension

    $extension = pathinfo($filename, PATHINFO_EXTENSION);

    

    // the physical file on a temporary uploads directory on the server

    $file = $_FILES['attachment']['tmp_name'];

    $size = $_FILES['attachment']['size'];

    

    if (!in_array($extension, ['zip', 'pdf', 'docx'])) {

      echo "You file extension must be .zip, .pdf or .docx";

    } elseif ($_FILES['attachment']['size'] > 1000000) { // file shouldn't be larger than 1Megabyte

      echo "File too large!";

    } else {

      // move the uploaded (temporary) file to the specified destination

      if (move_uploaded_file($file, $destination)) {

        

        $sender_name = $_POST['sender_name'];

        $contact = $_POST['contactnumber'];

        $sender_mail = $_POST['sender_email'];

        $description = $_POST['description'];

        $applied = date('Y-m-d');

        

        $jobapply = "INSERT INTO `job_submission`(`NAME`, `CONTACT`, `EMAIL`, `MESSAGE`, 

 `APPLIED_ON`, `CAREER_ID`,`CV`) VALUES 

 ('$sender_name','$contact','$sender_mail','$description','$applied','$idc','$filename')";

        

        if (mysqli_query($connect, $jobapply)) {

          echo "You Application Was Submitted Successfully! We Wish You All The Best";

        }

      } else {

        echo "Failed to upload file.";

      }

    }

The results of this code is the file name along with the other data are stored in the database and on the other hand the file is also stored in the uploads directory.

Now i want to download the file stored in the folder to the machine by using a button. for which I have written a code as follows,

 if (isset($_GET['file_id'])) {

 $id = $_GET['file_id'];

 // fetch file to download from database

 $sql = "SELECT * FROM job_submission WHERE JOB_ID='$id'";

 $result = mysqli_query($connect, $sql);

 $file = mysqli_fetch_assoc($result);

 $filepath = 'uploads/' . $file['CV'];

 if (file_exists($filepath)) {

    header('Content-Description: File Transfer');

    header('Content-Type: application/octet-stream');

    header('Content-Disposition: attachment; filename=' . basename($filepath));

    header('Expires: 0');

    header('Cache-Control: must-revalidate');

    header('Pragma: public');

    header('Content-Length: ' . filesize('uploads/' . $file['CV']));

    readfile('uploads/' . $file['CV']);

    exit;

}

}

The above code is called from a button inside a table,

<td><a href="careers.php?file_id=<?php echo $rowselect['JOB_ID'] ?>">Download</a> </td>

The file gets downloaded but it doesn't open and throws an error saying

Error Failed to load PDF document.

---

My Answer:
"Invalid file type. Only zip, pdf, and docx files are allowed."