Direct Download of Images (and Other Files)

Let your site visitors tap on an image to download the image. Or download any other file type you allow.

The download begins immediately. There is no new page load.

The link being tapped goes to a PHP script with the location of the file to download.

The "Download This" PHP script sends the file to the browser, nudging the browser to save the file on the person's hard drive instead of displaying it in the browser window.

There is special security coding within the PHP script.

1. It will download only files within the document root and subdirectories — to prevent hackers from downloading password or other confidential files that may reside at other areas of the server.

2. It will download only files with file name extensions you authorize — so only file types you authorize can be downloaded.

Constructing Links

For these examples, we'll assume the PHP script is installed on your server at /php/downloadthis.php (the examples are color-coded). Change the location if needed.

Here is code for a link that downloads the image being clicked on:

<a href="/php/downloadthis.php?/images/image.gif">
<img src="/images/image.gif">
</a>

You'll notice that the /images/image.gif file location is the same for both the link and for the src of the image tag. Tapping on the image will download the image.

To use the code for your image, replace /images/image.gif with the URL of the image relative to document root.

For security reasons, URLs for files to download must be relative to the document root. And no double‑dot ("..") directory traversing may be done.

As an illustration, if the file's URL is https://example.com/images/image.gif then the URL relative to the document root is /images/image.gif

Here is another example. It is coded to download a PDF:

<a href="/php/downloadthis.php?/ebooks/book.pdf">
Tap to download the PDF.
</a>

Replace /ebooks/book.pdf with the relative URL of the file to be downloaded.

Publish your links and you're good to go. Well, after installing the PHP script.

Installing the "Download This" PHP Script

Here is the source code for the "Download This" PHP script. Save it as downloadthis.php or other PHP file name that makes sense to you. (All instructions and examples assume downloadthis.php is the file name.) Customization notes follow the source code.

<?php
/*
Download This (a file downloader)
Version 1.0
August 1, 2018
Will Bontrager Software LLC
*/
/* One customization area:
     Between the $Extensions=<<<EXTENSIONS line and 
       the EXTENSIONS; line, specify the file name extensions 
       of the files that may be downloaded. Separate extensions 
       with spaces, commas, and/or line breaks. Blank lines are OK.
*/
$Extensions=<<<EXTENSIONS
jpg
jpeg
gif
png
svg
EXTENSIONS;

if( empty($_SERVER['QUERY_STRING']) ) { exit; }
$image = urldecode($_SERVER['QUERY_STRING']);
if( strpos($image,'..') !== false ) { exit; }
$image = "{$_SERVER['DOCUMENT_ROOT']}$image";
if( ! file_exists($image) ) { exit; }
$ta = explode('.',$image);
$extension = array_pop($ta);
$proceed = false;
foreach( preg_split('/[\r\n,\.]+/',trim($Extensions)) as $test )
{
    if( $extension == trim($test) )
    {
        $proceed = true;
        break;
    }
}
if( ! $proceed ) { exit; }
$ta = explode('/',$image);
$filename = array_pop($ta);
header('Content-Type:application/octet-stream');
header("Content-Disposition:attachment; filename=\"$filename\"");
readfile($image);
exit;
?>

Customization Notes

There is only one place to customize, to specify the file name extensions of files that may be downloaded.

In the source code, you'll see an area between lines 13 and 19 with a list of file name extensions for image files (colored blue).

The area begins below this line

$Extensions=<<<EXTENSIONS

And the area ends above this line

EXTENSIONS;

Between those two lines is where you specify the file name extensions of files that may be downloaded. You may remove or add extensions according to your requirements.

Separate extensions with one or more line feeds, spaces, and/or commas. That means they may be one extension per line, like in the downloaded source code, or there may be several per line. Like:

$Extensions=<<<EXTENSIONS
jpg .jpeg gif
  png,    svg
EXTENSIONS;

The dot/period/full stop character in front of the file extension is optional.

Download This asks you to specify allowed files instead of disallowed files. It is easier to specify what is allowed then to try to think of every file type that is not allowed.

When the customization has been completed, upload the PHP script to your server. Make a note of its URL so you can use it when you construct direct download links.

Logging Downloads

Logging is not implemented in the downloaded source code. But it's easy enough to add the feature.

To log the number of downloads, insert a line of PHP code into the Download This script.

Near the bottom of the PHP script, insert the following line immediately above the line composed of exit;

file_put_contents( "filename.txt", "X", FILE_APPEND);

Change filename.txt to the location of the file that will be the log file. The directory where the log file is located must be a writable directory.

The line you just added will append an "X" to the log file every time a file is downloaded. The size of the file is a count of the number of downloads.

When Download This is implemented, tapping on an image or text link downloads a file. The downloaded file may be an image or other type of file — depending on how you construct the link and which file name extensions are allow.

(This article first appeared with an issue of the Possibilities newsletter.)

Will Bontrager