...

View Full Version : Cannot modify header information



lamasu
12-18-2010, 06:06 PM
Hey,
I'm working on a big PHP/MYSQL image upload service and I got the upload part up and running. There's just one problem in my download.php script when I try and download the images from the database these errors show up:

Warning: Cannot modify header information - headers already sent by (output started at E:\xampp\htdocs\Comet10\wh\whPMS2\inc\scripts\download.php:7) in E:\xampp\htdocs\Comet10\wh\whPMS2\inc\scripts\download.php on line 23
Warning: Cannot modify header information - headers already sent by (output started at E:\xampp\htdocs\Comet10\wh\whPMS2\inc\scripts\download.php:7) in E:\xampp\htdocs\Comet10\wh\whPMS2\inc\scripts\download.php on line 24
Warning: Cannot modify header information - headers already sent by (output started at E:\xampp\htdocs\Comet10\wh\whPMS2\inc\scripts\download.php:7) in E:\xampp\htdocs\Comet10\wh\whPMS2\inc\scripts\download.php on line 25

Now here's my PHP:


if(isset($_GET['id']))
{
$con = mysql_connect("localhost","****","****");
mysql_select_db("wh", $con);
$id = $_GET['id'];
$query = "SELECT productMainimage_size, productMainimage_type, productMainimage " .
"FROM products WHERE productMainimage_name = '$id'";
$name = $row['productMainimage_name'];
$type = $row['productMainimage_type'];
$size = $row['productMainimage_size'];
$content = $row['productMainimage'];

$result = mysql_query($query) or die('Error, query failed' .trigger_error(mysql_error()));
list($name, $type, $size, $content) = mysql_fetch_array($result);
header("Content-length: $size");
header("Content-type: $type");
header("Content-Disposition: attachment; filename=$name");
echo $content;

mysql_close($con);
exit;
}


Hope one of you guys can help with this frustrating problem.:eek::confused:

120
12-18-2010, 06:15 PM
It's pretty much telling you what the problem is - and several times at that. It even gives you the line number:

download.php:7

You have already written some output at line 7 of download php, so your attempts to write certain headers is nonsensical.

Without seeing the rest of the script, it's impossible to say what is going on, but here is the best advice I can give... start at LINE 7 of download.php :)

lamasu
12-18-2010, 07:53 PM
Yeah I figured that one out already only thing is that the <?php
tag is on line 7.

MattF
12-18-2010, 07:55 PM
Yeah I figured that one out already only thing is that the <?php
tag is on line 7.

You have HTML content before that line, hence the output.

lamasu
12-18-2010, 07:56 PM
Oh and here's the rest of the script:


<html>
<head>
<title>Download File</title>
</head>
<body>



<?php
if(isset($_GET['id']))
{
$con = mysql_connect("localhost","****","****");
mysql_select_db("wh", $con);
$id = $_GET['id'];
$query = "SELECT productMainimage_size, productMainimage_type, productMainimage " .
"FROM products WHERE productMainimage_name = '$id'";
$name = $row['productMainimage_name'];
$type = $row['productMainimage_type'];
$size = $row['productMainimage_size'];
$content = $row['productMainimage'];

$result = mysql_query($query) or die('Error, query failed' .trigger_error(mysql_error()));
list($name, $type, $size, $content) = mysql_fetch_array($result);
header("Content-length: $size");
header("Content-type: $type");
header("Content-Disposition: attachment; filename=$name");
echo $content;

mysql_close($con);
exit;
}
?>



</body>
</html>

lamasu
12-18-2010, 07:57 PM
You get the same result with or without the HTML.

120
12-18-2010, 07:59 PM
Yes, that write, you have written content with:


<html>
<head>
<title>Download File</title>
</head>
<body>
It's too late to send headers after this :-) Send them before, and check you are calling the latest version of the script (your browser/server is not caching)

Also worth mentioning that script is vulnerable to SQL injection attacks. If I manipulate the querystring so it unfolds to:


0; drop table products;# or worse

0; drop database wh;#

You may see the issue.

lamasu
12-18-2010, 08:08 PM
I gave it a try yet with no result although the error message changed to:

Warning: Header may not contain more than a single header, new line detected. in E:\xampp\htdocs\Comet10\wh\whPMS2\inc\scripts\download.php on line 16

And line 16 contains:


header("Content-length: $size");

120
12-18-2010, 08:12 PM
I gave it a try yet with no result although the error message changed to:

Warning: Header may not contain more than a single header, new line detected. in E:\xampp\htdocs\Comet10\wh\whPMS2\inc\scripts\download.php on line 16

And line 16 contains:


header("Content-length: $size");

OK. So what do you think: "Header may not contain more than a single header" may mean? TRY THIS LINK (http://lmgtfy.com/?q=Header+may+not+contain+more+than+a+single+header).

Personally I would have a look at the output off of the server with something like LIVE HTTP HEADERS and see what it's spitting out.

Inigoesdr
12-18-2010, 10:08 PM
Personally I would have a look at the output off of the server with something like LIVE HTTP HEADERS and see what it's spitting out.

I would venture a guess that it's the $size variable in the header() (http://php.net/header) call that the error points to. $size has a newline in it, and you can't set headers with newlines.



EZ Archive Ads Plugin for vBulletin Copyright 2006 Computer Help Forum