php - 使用 php 和 mysql 损坏上传的文件

Question

我需要在我自己的小项目中使用php/mysql上传和下载文件。

文件使用 POST 通过表单上传，并按以下方式处理:

<?
$passName1 = $_FILES['passport1']['name'];
$tmpName1  = $_FILES['passport1']['tmp_name'];
$fileSize1 = $_FILES['passport1']['size'];
$fileType1 = $_FILES['passport1']['type'];
$fp1      = fopen($tmpName1, 'r');
$pass_1_content = fread($fp1, filesize($tmpName1));
fclose($fp1);
?>

然后我使用这个函数上传它们:

$passport1id = insert_user_file ($db, $passName1, $fileType1, $fileSize1, $pass_1_content);

function insert_user_file ($db, $name, $type, $size, $content) {
        try {
            echo "<br>start insert file $name";
            $insertfile = new PDO("mysql:host=".$db['server'].";dbname=".$db['db'], $db['mysql_login'], $db['mysql_pass'], array(PDO::MYSQL_ATTR_INIT_COMMAND => 'SET NAMES utf8'));
            // set the PDO error mode to exception
            $insertfile->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

            // prepare sql and bind parameters
            $stmt=$insertfile->prepare ("INSERT INTO files (name, size, type, content, created) VALUES (:name, :size, :type, :content, NOW())");

            $stmt->bindParam(":name", $name);
            $stmt->bindParam(":size", $size);
            $stmt->bindParam(":type", $type);
            $stmt->bindParam(":content", $content);
            $stmt->execute();

            $file_id = $insertfile->lastInsertId();
            return $file_id;
        }
        catch(PDOException $e) {
            echo 'error: '. $e->getMessage();
            return false;
        }
    }

文件名称/内容中是否存在 addslashes() 似乎根本没有任何区别。似乎工作正常但是当我用下面的函数取回文件时，它似乎已损坏:

get_file ($db, $_GET['id']);

function get_file ($db, $fileid){
        try {
            $get_file = new PDO("mysql:host=".$db['server'].";dbname=".$db['db'], $db['mysql_login'], $db['mysql_pass'], array(PDO::MYSQL_ATTR_INIT_COMMAND => 'SET NAMES utf8'));
            $get_file->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
            $file = $get_file->prepare("SELECT * FROM files where fileid=:fileid");
            $file->bindParam(":fileid", $fileid);
            $file->execute();
            $file_data = $file->fetch(PDO::FETCH_ASSOC);
            header('Content-Description: File Transfer');
            header('Content-Type: application/octet-stream');
            header('Content-Transfer-Encoding: binary');
            header('Connection: Keep-Alive');
            header('Expires: 0');
            header("Content-length: {$file_data['size']}");
            header("Content-type: {$file_data['type']}");
            header("Content-Disposition: attachment; filename={$file_data['name']}");
            echo $file_data['content'];
            exit;
        }
        catch(PDOException $e) {
            //echo 'error: '. $e->getMessage();
            return false;
        }
    }

Answer 1

我已经解决了这个问题!愚蠢的我，我应该把整个代码放在这里，因为它导致困惑!

<?php
    ob_start();
    session_start();
    require_once 'functions.php';

    /*
    if(!isset($_SESSION['logged']) OR $_SESSION['logged'] == false){
        header ("Location: index.php");
        exit;
    }
    */

    //somecode here
    //echo "logged in ok";
    get_file ($db, $_GET['id']);


?>

罪魁祸首在第 2 行 ob_start();它覆盖了像这样的警告:

Warning: Cannot modify header information - headers already sent by (output started at /sata2/home/users//functions.php:289) in /sata2/home/users//functions.php on line 130

第 289 行在 之后有几个空格？>//这里有一些空格

这是一个非常愚蠢的错误。非常感谢@MarcB 暗示我可能会错过一些警告。不要在 ?>

后留下空格