title: PHP File Download stops
body: <p>I am writing a basic license-validated PHP download script. The target file is about 50MB, and it works for some. Others can't finish it, sometimes retrying it works.</p>
  
  <p>Here is the script: </p>
  
  <pre><code>$method = $_GET['method'];
      if($method == "webdownload") {
          $airlineid = $_GET['airline'];
  
          $sql = "SELECT * FROM airlines WHERE airlineid='$airlineid'";   
          $result = mysql_query($sql) or die(mysql_error());
          $row = mysql_fetch_array($result);
          if($row['licensekey'] == "")
              die("Invalid airline id");
  
          $filename = $row['code'].'_installer.exe';
          $file_path = '../resources/application/files/'.$row['airlineid'].'/'.$row['clientversion'].'/application_installer.exe';
          if($row['licensestate'] != "OK")
              die("The license associated with this downloaded has been deauthorized.");
  
          if(!is_file($file_path))
              die("The file associated with this version for this airline appears to be invalid.");
          //download code here - it runs once only, if refreshed it will not allow it.                
  
          header('Content-type: application/exe');
          header("Content-Disposition: attachment; filename=".$filename);
          header("Content-Length: ".filesize($file_path));
          header("Content-Transfer-Encoding: binary");    
  
          header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
          header('Pragma: public');   
  
          //header('X-Sendfile: '.$file_path); I tried this - it had no effect and I want the portability.
  
          $file = @fopen($file_path,"rb");
          while(!feof($file)) {           
              $buffer = fread($file, 1024 * 8);
              print($buffer);
              flush();            
          }
          close($file);       
      }
  </code></pre>
  
  <p>EDIT: Upon advice, I discovered that the script, among others, is highly vulnerable to SQL injection. I have replaced direct variable-SQL expressions with the use of this function:</p>
  
  <pre><code>        function secure_string($raw) {
      $sid = strtolower($raw);
      $sid = str_replace("'","_SINGLE_QUOTE", $sid);
      $sid = str_replace('"','_DOUBLE_QUOTE', $sid);
  
  
      $cmd[0] = "insert";
      $cmd[1] = "select";
      $cmd[2] = "union";
      $cmd[3] = "delete";
      $cmd[4] = "modify";
      $cmd[5] = "replace";
      $cmd[6] = "update";
      $cmd[7] = "create";
      $cmd[8] = "alter";
  
  
      for($index = 0; $index &lt;= 8; $index++) {
          $sid = str_replace($cmd[$index],"_SQL_COMMAND", $sid);
      }
  
      return $sid;        
  }
  </code></pre>
  
  <p>Is that sufficient to block SQL-injection?  </p>
  
  <p>EDIT2: I have used this function in conjunction with a PDO prepare functions to eliminate this exploit. Thanks 100x for letting me learn this lesson without disastrous results.</p>