What's the best way to supply download of a digital product in PHP?

Question

Digital commercial products that customers pay for download link.

I have put all the zipped files (products) outside of web document root and buyers download them via a php script which is integrated with paypal IPN to make sure the downloader is a paying buyer.

Sort of like: http://www.mysite.com/download.php?buyer_id=xxx

Thus far it all works with only one problem. The zip files I download via the URL above is corrupted and can't be opened correctly with WinRAR. However, directly downloaded zip is fine.

My code:

$path = WAREHOUSE_PATH.'/products/'.$identifier.'.zip';
$mm_type="application/octet-stream";
header("Pragma: public");
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Cache-Control: public");
header("Content-Description: File Transfer");
header("Content-Type: " . $mm_type);
header("Content-Length: " .(string)(filesize($path)) );
header('Content-Disposition: attachment; filename="'.basename($path).'"');
header("Content-Transfer-Encoding: binary\n");

$fp = @fopen($path,"rb");
if ($fp) {
  while(!feof($fp)) {
    print(fread($fp, 1024*8));
    flush();
    if (connection_status()!=0) {
      @fclose($fp);
      die();
    }
  }
  @fclose($fp);
}

What could be wrong? Thanks!

Problem solved: Thank you all for the tips. It turns out that the downloaded packages contains a few extra white spaces which shouldn't be there. Silly.

Answer 1

You have an extra newline character for your Content-Transfer-Encoding header - perhaps that is resulting in three newline characters between the last header and the body?

Answer 2

I would suggest changing this:

$fp = @fopen($path,"rb");
if ($fp) {
  while(!feof($fp)) {
    print(fread($fp, 1024*8));
    flush();
    if (connection_status()!=0) {
      @fclose($fp);
      die();
    }
  }
  @fclose($fp);
}

to this

readfile($path);

You can find more info on readfile here, but basically it will do everything your loop does.

Answer 3

You'd be better off just using readfile(). Unless you have ignore_user_abort on, then the script will terminate automatically if the user cancels anyway.

If you're still having problems, load the file up in a hex editor and compare the first few characters and the last few characters.