PHP - Download file from external server, filename has quotes “ ' ” : 'filename.zip'

Question

I made a script where depending on the request the server will return a specific file for download from an external source, I use an external source because I have unlimited bandwidth on the other server:

$ch = curl_init();
$url="http://www.example.com/downloads/$fileName";
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_NOBODY, true); // make it a HEAD request
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
$head = curl_exec($ch);

$mimeType = curl_getinfo($ch, CURLINFO_CONTENT_TYPE);
$size = curl_getinfo($ch, CURLINFO_CONTENT_LENGTH_DOWNLOAD);

header("Cache-Control: public");
header("Content-Description: File Transfer");
header("Content-Type: $mimeType");
header("Content-length: $size");
header("Content-Transfer-Encoding: binary"); 
header("Content-Disposition:attachment;filename='$fileName'");
readfile($url);

$filename comes from the request on the front end. It is a simple post from a form.

Everything works great, but some users, not all, have reported that they cant open the file because the file name has quotes: 'filename.zip' , instead of filename.zip

I hit a wall, I have no idea even where to start looking, apparently this happens with some mac users. Any ideas?

Answer 1

The HTTP standard would have you putting double quotes around the filename parameter in the Content-Disposition header. That might look like this in your code:

header('Cache-Control: public');
header('Content-Description: File Transfer');
header('Content-Type: ' . $mimeType);
header('Content-Type:application/octet-stream');
header('Content-length: ' . $size);
header('Content-Transfer-Encoding: binary'); 
header('Content-Disposition:attachment;filename="' . $fileName . '"');
readfile($url);

Note here that I have changed all your PHP string definitions to use single quotes to present all string definitions consistently.