Page 1 of 1
Dynamic Image Filename
Posted: Tue Jul 04, 2006 8:36 am
by s.dot
I'm using a script to generate an image that I want the user to right click on and save. I'm passing the desired file name through $_GET
Code: Select all
<img src="img.php?size=450&type=2&filename=abcdef.jpg" alt="Image">
When the user tries to save the file, it's saved as img.jpg (the name of the script). I would like it to be $_GET['filename'].
I've played around with header('Content-disposition'); but I don't think this is what I want.
Posted: Tue Jul 04, 2006 8:45 am
by Jenk
It would be a lot better for you to use a different method to set the filename, else the user could put in which ever filename they like and, dependant upon your logic, choose any damn file they like..
Anyway, to answer your question:
Code: Select all
header('Content-disposition: attachment;filename=' . $_GET['filename'] . ';');
Though I say again.. be careful.
Add the necessary filtering and validation to the above as well, a whitelist approach is the best in these situations.
Posted: Tue Jul 04, 2006 8:47 am
by s.dot
well my script generates the name, and is transparent to the user, although i suppose they could just go directly to the image script and try something, so good advice!
Posted: Tue Jul 04, 2006 8:52 am
by s.dot
Your proposed solution works in FF but not in IE. Is there a hack I should be aware of?
Posted: Tue Jul 04, 2006 8:56 am
by Jenk
not that I know of, sorry.
I'm sure a google for 'content-disposition' would be able to turn something up though.
EDIT: It could be the space between the : and the a of attachement.
Posted: Tue Jul 04, 2006 11:42 am
by s.dot
Alright, so using the filename, it appears it has to be in the same directory as the script that's executing it?
For Example
Code: Select all
header('Content-disposition: attachment; filename=up/filename.jpg;);
That is the relative path to the file. up/filename.jpg
IE, will not respect this and saves the file as img.jpg (the name of the script that produces the image)
FF, will respect that and saves the image with the name up-filename.jpg... converting the / to a - which is fine with me.
If I try to make the filename "filename.jpg" in the header, it will not produce the image.
So, how do I reflect the correct filename in the header?