Php 按手动设置的文件ID下载文件

我想用PHP按文件id制作一个文件下载部分

我的理念是：

• 我通过文件管理器/ftp客户端上传文件

• 我决定一个文件id，然后在“Admin_Index.php”页面注册该文件 Id和我上载的文件路径

• 用户可以从“PAGE.html”文件下载，其中有下载链接 我可以在“download.php”中查询并检查 文件id是否存在。如果存在，则查询中的路径将 存储在php标头中并重定向

但是它不能正常工作。。文件代码如下所示

Admin_index.php的代码

<strong>Welcome to Admin Panel For File Registration Into DB</strong><br>
<form action="dbreg.php" method="post">
File Id : <input type="text" name="fid" value="" /><br />
Path : <input type="url" name="fpath" value="" maxlength="250"/><br />
<input type="submit" value="Add to DB" />
</form>

<?php 
        $iden=$_GET['idn'];
        if ($iden==null and $iden=="")
        {
        echo 'Register DB Here';
        }
        if ($iden==2)
        {
        echo 'File ID With path Successfully Added';
        }
        if ($iden==1)
        {
        echo 'File Id Already Exist , Please try with a new one';
        }

        ?>

<?php
$mysql_hostname = "localhost";
$mysql_user = "user";
$mysql_password = "******";
$mysql_database = "database";

$bd = mysql_connect($mysql_hostname, $mysql_user, $mysql_password) or die("Could not connect database");
mysql_select_db($mysql_database, $bd) or die("Could not select database");
?>

<?php
session_start();
include('connection.php');
$id=$_POST['fid'];
$path=$_POST['fpath'];

$qry="select id from files where id= $id";
$result=mysql_query($qry);

if($result) {
    if($result->num_rows == 0)
    {  $idn=2; // means the id does not exist 
        mysqli_query("INSERT INTO files(id, path) VALUES ('$id', '$path')");
        header('location: index.php?idn=2');  }
    else if($result->num_rows >0)
    {  $idn=1; // means the id does exist 
    header('location: index.php?idn=1'); } } 

?>

<?php
session_start();
include('connection.php');
$idd=$_GET['id'];
$qry="select id,path from files where id= $idd";
$result=mysql_query($qry);

if($result) {
    if($result->num_rows == 0)
    { $idn=0;
        echo '404 Error! No file exists with that ID'; }
    else if($result->num_rows == 1)
    { $idn=1; // file id exist
        $row = mysql_fetch_assoc($result);
    $filename=$row['path']; 
header("$filename");} }
     else { echo 'Error! File ID is Required.';}

欢迎使用管理面板将文件注册到DB

文件Id:

路径：

connection.php的代码

<strong>Welcome to Admin Panel For File Registration Into DB</strong><br>
<form action="dbreg.php" method="post">
File Id : <input type="text" name="fid" value="" /><br />
Path : <input type="url" name="fpath" value="" maxlength="250"/><br />
<input type="submit" value="Add to DB" />
</form>

<?php 
        $iden=$_GET['idn'];
        if ($iden==null and $iden=="")
        {
        echo 'Register DB Here';
        }
        if ($iden==2)
        {
        echo 'File ID With path Successfully Added';
        }
        if ($iden==1)
        {
        echo 'File Id Already Exist , Please try with a new one';
        }

        ?>

<?php
$mysql_hostname = "localhost";
$mysql_user = "user";
$mysql_password = "******";
$mysql_database = "database";

$bd = mysql_connect($mysql_hostname, $mysql_user, $mysql_password) or die("Could not connect database");
mysql_select_db($mysql_database, $bd) or die("Could not select database");
?>

<?php
session_start();
include('connection.php');
$id=$_POST['fid'];
$path=$_POST['fpath'];

$qry="select id from files where id= $id";
$result=mysql_query($qry);

if($result) {
    if($result->num_rows == 0)
    {  $idn=2; // means the id does not exist 
        mysqli_query("INSERT INTO files(id, path) VALUES ('$id', '$path')");
        header('location: index.php?idn=2');  }
    else if($result->num_rows >0)
    {  $idn=1; // means the id does exist 
    header('location: index.php?idn=1'); } } 

?>

<?php
session_start();
include('connection.php');
$idd=$_GET['id'];
$qry="select id,path from files where id= $idd";
$result=mysql_query($qry);

if($result) {
    if($result->num_rows == 0)
    { $idn=0;
        echo '404 Error! No file exists with that ID'; }
    else if($result->num_rows == 1)
    { $idn=1; // file id exist
        $row = mysql_fetch_assoc($result);
    $filename=$row['path']; 
header("$filename");} }
     else { echo 'Error! File ID is Required.';}

“dbreg.php”的代码

---

您的代码易受SQL注入攻击。您应该继续阅读。**谢谢@Gumbo**“工作不正常”不是问题。你必须描述它失败的地方，或者错误是什么，或者在任何人回答之前给出一些需要回答的线索。实际上，当我在Admin_Index.php页面中插入文件id和路径时，它显示**“成功添加了路径的文件id”**但在数据库中没有插入id和路径！！！！数据库保持空白！