Diese Seite bei php.net
The PHP manual text and comments are covered by the Creative Commons Attribution 3.0 License © the PHP Documentation Group - Impressum - mail("TO:Reinhard Neidl",...)
(PHP 4, PHP 5)
header — Sendet einen HTTP-Header in Rohform
header() wird zum Senden von HTTP-Anfangsinformationen (Headern) im Rohformat benutzt. Weitere Informationen über die HTTP Header finden Sie in der » HTTP/1.1 Spezifikation.
Beachten Sie, dass Sie die Funktion header() aufrufen müssen, bevor Sie irgendeine andere Art von Ausgabe (seien es normale HTML-Tags, Leerzeilen in einer Datei oder von PHP) zum Client schicken. Es handelt sich hier um einen typischen Fehler, der zum Beispiel auftritt, wenn Sie Code mittels include() oder require() oder einer anderen Dateizugriffs-Funktion einlesen, die Leerzeichen oder Leerzeilen enthalten, die ausgegeben werden, bevor header() aufgerufen wird. Das gleiche Problem kann auch auftreten, wenn Sie eine Datei verwenden, in der HTML und PHP vermischt wurden.
<html>
<?php
/* Dies wird einen Fehler provozieren. Beachten Sie die vorangehende Ausgabe,
* die vor dem Aufruf von header() erzeugt wird */
header('Location: http://www.example.com/');
?>
Der Header-String.
Es gibt zwei Spezialfälle von Header-Aufrufen. Der erste ist ein Header, der mit "HTTP/" beginnt (ob Groß- oder Kleinschreibung ist nicht relevant) und zum Herausfinden des zu sendenden HTTP Statuscodes verwendet wird. Wenn Sie zum Beispiel Apache konfiguriert haben, um ein PHP Skript zum Bearbeiten von Anforderungen fehlender Dateien (mittels der ErrorDocument-Direktive) zu verwenden, möchten Sie bestimmt sicherstellen, dass Ihr Skript den passenden Statuscode generiert.
<?php
header("HTTP/1.0 404 Not Found");
?>
Der zweite Spezialfall ist der "Location:" Header. Es wird nicht nur der Header an den Browser geschickt, sondern auch ein REDIRECT (302) Statuscode, wenn nicht bereits der 201- oder ein 3xx-Statuscode gesendet wurde.
<?php
header("Location: http://www.example.com/"); /* Browser umleiten */
/* Stellen Sie sicher, dass der nachfolgende Code nicht ausgefuehrt wird, wenn
eine Umleitung stattfindet. */
exit;
?>
Der optionale Parameter replace gibt an, ob der Header einen vorhergehenden gleichartigen Header ersetzten soll, oder ob ein zweiter Header des selben Typs hinzugefügt werden soll. Standardmäßig wird ersetzt; wenn Sie als zweites Argument FALSE übergeben, können Sie so mehrere Header desselben Typs erzwingen. Zum Beispiel:
<?php
header('WWW-Authenticate: Negotiate');
header('WWW-Authenticate: NTLM', false);
?>
Forciert einen HTTP-Response-Code des angegebenen Wertes.
Es wird kein Wert zurückgegeben.
| Version | Beschreibung |
|---|---|
| 4.4.2 and 5.1.2 | Die Funktion unterbindet das gleichzeitige Versenden mehrerer Header zum Schutz gegen Header-Injection-Angriffe. |
| 4.3.0 | Der Parameter http_response_code wurde hinzugefügt. |
| 4.0.4 | Der Parameter replace wurde hinzugefügt. |
Beispiel #1 Download-Dialog
Wollen Sie den Benutzer auffordern, die von Ihnen gesendeten Daten wie z.B. eine generierte PDF Datei zu speichern, können Sie den Header » Content-Disposition verwenden, um einen empfohlenen Dateinamen anzubieten und den Browser zu zwingen, den Dialog zum Speichern anzuzeigen.
<?php
// Wir werden eine PDF Datei ausgeben
header('Content-type: application/pdf');
// Es wird downloaded.pdf benannt
header('Content-Disposition: attachment; filename="downloaded.pdf"');
// Die originale PDF Datei heißt original.pdf
readfile('original.pdf');
?>
Beispiel #2 Caching-Direktiven
PHP-Skripte erzeugen oft dynamische Inhalte, die weder vom Browser noch von irgendeinem Proxy zwischen Web-Server und Client-Browser gepuffert ("gecached") werden sollen bzw. dürfen. Bei vielen Proxies und Browsern kann das Cachen wie folgt unterbunden werden:
<?php
header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); // Datum in der Vergangenheit
?>
Hinweis:
Es könnte auch sein, dass Ihre Seiten nicht zwischengespeichert werden, auch wenn Sie obigen Header nicht ausgeben. Es gibt eine Anzahl Optionen, welche die Benutzer in ihren Browser einstellen können, um das standardmäßige Caching-Verhalten zu verändern. Durch das Senden obiger Header sollten Sie jedwede Einstellungen, die die Ausgabe Ihres Skriptes zwischenspeichern würden, außer Kraft setzen.
Weiterhin können Sie session_cache_limiter() und die Konfigurationsoption session.cache_limiter verwenden, um die korrekten Header bezüglich Caching automatisch generieren zu lassen, sollten Sie Sessions benutzen.
Hinweis:
Sie können dieses Problem umgehen, indem Sie Outputbuffering benutzen, mit dem Overhead, dass Ihre gesamten Ausgaben an den Browser auf dem Server gepuffert werden, bis Sie diese senden. Sie können dies tun, indem Sie in Ihrem Skript ob_start() und ob_end_flush() verwenden, oder indem Sie die Konfigurationsdirektive output_buffering in der php.ini bzw. in den Server-Konfigurationsdateien auf On setzen.
Hinweis:
Die HTTP-Status-Headerzeile wird immer die erste zum Client gesendete sein, egal ob der aktuelle header()-Aufruf der erste ist oder nicht. Der Status kann mittels header() jederzeit mit einer neuen Statuszeile überschrieben werden, sofern die HTTP-Header noch nicht gesendet wurden.
Hinweis:
Der Microsoft Internet Explorer 4.01 hat einen Bug, der diese Funktionalität verhindert, und es gibt keinen Workaround. Auch im Microsoft Internet Explorer 5.5 existiert ein Bug, der dies behindert, dieser kann jedoch mittels eines Upgrades auf Service Pack 2 oder höher behoben werden.
Hinweis: Ist safe mode aktiviert, wird die UID des Skriptes dem realm-Teil des Headers WWW-Authenticate (für HTTP Authentifizierung verwendet) hinzugefügt, sollten Sie diesen Header setzen.
Hinweis:
HTTP/1.1 verlangt einen absoluten URI inklusive dem Schema, Hostnamen und absoluten Pfad als Argument von » Location:, aber manche Clients akzeptieren auch relative URIs. Gewöhnlich können Sie mittels $_SERVER['HTTP_HOST'], $_SERVER['PHP_SELF'] und dirname() aus einem relativen Link einen absoluten URI selbst erstellen:
<?php
/* Redirect auf eine andere Seite im aktuell angeforderten Verzeichnis */
$host = $_SERVER['HTTP_HOST'];
$uri = rtrim(dirname($_SERVER['PHP_SELF']), '/\\');
$extra = 'mypage.php';
header("Location: http://$host$uri/$extra");
exit;
?>
Hinweis:
Die Session-ID wird nicht mit dem Location-Header übermittelt, selbst wenn session.use_trans_sid eingeschaltet ist. Sie muss daher manuell durch Verwendung der SID-Konstante hinzugefügt werden.
I see a couple of notes where multiple Content-Type headers are sent. Don't do that.
RFC2616 only presents two scenarios for multiple Content-Type headers in a response:
1. a "300 Multiple Choice" status for agent-drive negotiation, or
2. a response containing multi-part content.
Note also that multiple Content-Type headers reportedly breaks FastCGI.
For avoiding double prompt when choose open (not save)
header('Content-Type: application/download');
header('Content-Disposition: filename=dati.txt');
As known redirecting to a page inside your domain with header() does not pass along $_session variables.
Strange thing is that it is client dependant.
sometimes as stated session_write_close() before using header helps.
I've noticed that if the redirect doesn't point to the full URL of the page e.g.
"Location: example.com/page2.php"
but instead to
"Location: /page2.php"
The session does get perserved with no need to append data manually to the url.
<?php
$url = 'http://sharecash.org.tw';
is_valid_url ($url);
function is_valid_url ( $url )
{
$url = @parse_url($url);
if ( ! $url) {
return false;
}
$url = array_map('trim', $url);
$url['port'] = (!isset($url['port'])) ? 80 : (int)$url['port'];
$path = (isset($url['path'])) ? $url['path'] : '';
if ($path == '')
{
$path = '/';
}
$path .= ( isset ( $url['query'] ) ) ? "?$url[query]" : '';
if ( isset ( $url['host'] ) AND $url['host'] != gethostbyname ( $url['host'] ) )
{
if ( PHP_VERSION >= 5 )
{
$headers = get_headers("$url[scheme]://$url[host]:$url[port]$path");
}
else
{
$fp = fsockopen($url['host'], $url['port'], $errno, $errstr, 30);
if ( ! $fp )
{
return false;
}
fputs($fp, "HEAD $path HTTP/1.1\r\nHost: $url[host]\r\n\r\n");
$headers = fread ( $fp, 128 );
fclose ( $fp );
}
$headers = ( is_array ( $headers ) ) ? implode ( "\n", $headers ) : $headers;
return ( bool ) preg_match ( '#^HTTP/.*\s+[(200|301|302)]+\s#i', $headers );
}
return false;
}
?>
Return:
HTTP/1.1 200
I'm trying to get image from google charts api via curl.
Here is part of the code:
<?php
header('Content-Type: image/png');
echo $this->chart->getChart();
___________________________
private function getChart() {
$ch = curl_init('http://chart.apis.google.com/chart?chid='
.md5(uniqid(rand(), true)).'&'.
http_build_query($this->_post));
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch,CURLOPT_POST,count($this->_post));
curl_setopt($ch,CURLOPT_POSTFIELDS,
http_build_query($this->_post));
$response = curl_exec($ch);
$file = fopen('/path/to/test/graph.png', 'w+');
fwrite($file, $response);
fclose($file);
return $response;
}
?>
The problem after calling this I get error "The image can not be displayed, because it contains errors".
If I open saved file /path/to/test/graph.png it is OK.
The difference is 2 bites at the beginning of received response. \r\n is prepended.
How can fix this?
in response to marcel dot glacki at stud dot fh-swf dot de
The "refresh" header in your example is not part of the HTTP standard, it was a proprietary extension invented by Netscape. It's use is discouraged by the W3C.
After lots of research and testing, I'd like to share my findings about my problems with Internet Explorer and file downloads.
Take a look at this code, which replicates the normal download of a Javascript:
<?php
if(strstr($_SERVER["HTTP_USER_AGENT"],"MSIE")==false) {
header("Content-type: text/javascript");
header("Content-Disposition: inline; filename=\"download.js\"");
header("Content-Length: ".filesize("my-file.js"));
} else {
header("Content-type: application/force-download");
header("Content-Disposition: attachment; filename=\"download.js\"");
header("Content-Length: ".filesize("my-file.js"));
}
header("Expires: Fri, 01 Jan 2010 05:00:00 GMT");
if(strstr($_SERVER["HTTP_USER_AGENT"],"MSIE")==false) {
header("Cache-Control: no-cache");
header("Pragma: no-cache");
}
include("my-file.js");
?>
Now let me explain:
I start out by checking for IE, then if not IE, I set Content-type (case-sensitive) to JS and set Content-Disposition (every header is case-sensitive from now on) to inline, because most browsers outside of IE like to display JS inline. (User may change settings). The Content-Length header is required by some browsers to activate download box. Then, if it is IE, the "application/force-download" Content-type is sometimes required to show the download box. Use this if you don't want your PDF to display in the browser (in IE). I use it here to make sure the box opens. Anyway, I set the Content-Disposition to attachment because I already know that the box will appear. Then I have the Content-Length again.
Now, here's my big point. I have the Cache-Control and Pragma headers sent only if not IE. THESE HEADERS WILL PREVENT DOWNLOAD ON IE!!! Only use the Expires header, after all, it will require the file to be downloaded again the next time. This is not a bug! IE stores downloads in the Temporary Internet Files folder until the download is complete. I know this because once I downloaded a huge file to My Documents, but the Download Dialog box put it in the Temp folder and moved it at the end. Just think about it. If IE requires the file to be downloaded to the Temp folder, setting the Cache-Control and Pragma headers will cause an error!
I hope this saves someone some time!
~Cody G.
Several times this one is asked on the net but an answer could not be found in the docs on php.net ...
If you want to redirect an user and tell him he will be redirected, e. g. "You will be redirected in about 5 secs. If not, click here." you cannot use header( 'Location: ...' ) as you can't sent any output before the headers are sent.
So, either you have to use the HTML meta refresh thingy or you use the following:
<?php
header( "refresh:5;url=wherever.php" );
echo 'You\'ll be redirected in about 5 secs. If not, click <a href="wherever.php">here</a>.';
?>
Hth someone
there are times when one would want to output a html status 500 'mid response'.
i wasn't able to get a clear answer weather sending a (be it incomplete) body with a 500 is proper, but what i found works nicely (assuming you are using output buffering, and haven't flushed the buffer before requiring a 500):
a) ..... some of the document body is buffered .....
b) ..... something happens that merits a html status 500 .....
c) ob_end_clean() - this will basically purge whatever document body is in the buffer 'to this point'
d) use header('.... to display the html status 500.
e) die();
what you are left with, is a html status 500, with no body.
nice and clean, just the way we like it :)
Also note, if you add a header line in addition to supply a status code in the same call, it will do both.
Example:
<?php header('WWW-Authenticate: Basic realm="My Realm"',true,401); ?>
Will output both:
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic realm="My Realm"
we use 204's extensively.
after doing some spring cleanup, we found out (as many others might have), that even tho you header('204..., the user agent will wait until the content-length header is received. which, at least via apache 2 (others probably) is not sent until the script has completed executing completely.
so, after doing some testing:
HTTP/1.0 204 No Content
Date: Sat, 27 Feb 2010 08:23:49 GMT
Server: Apache
Content-Length: 0
Vary: User-Agent,Accept-Encoding
Connection: close
Content-Type: text/html
is what is sent during a standard 204 response... so to reproduce this, the function we are using is:
header('HTTP/1.0 204 No Content');
header('Content-Length: 0',true);
header('Content-Type: text/html',true);
flush();
when the above is called prior to doing any processing, the user agent will be left alone to do other things, and you may continue doing (at times 'time' heavy) processing on the server end.
enjoy!
My files are in a compressed state (bz2). When the user clicks the link, I want them to get the uncompressed version of the file.
After decompressing the file, I ran into the problem, that the download dialog would always pop up, even when I told the dialog to 'Always perform this operation with this file type'.
As I found out, the problem was in the header directive 'Content-Disposition', namely the 'attachment' directive.
If you want your browser to simulate a plain link to a file, either change 'attachment' to 'inline' or omit it alltogether and you'll be fine.
This took me a while to figure out and I hope it will help someone else out there, who runs into the same problem.
Normally, using
<?php
// Request URI is /boo/blah.php
header("Location: /foo/bar.php");
?>
generates a header just like
<?php
// Request URI is /boo/blah.php
header("Location: /foo/bar.php");
?>
But when I once used
<?php
// Request URI is /boo/blah.php
header("Location: ../foo/bar.php");
?>
today, it generates an absolute path like
<?php
// Request URI is /boo/blah.php
header("Location: http://www.dummy.com/foo/bar.php");
?>
Funny. I guess php done the work.
AVOID ZERO BYTE ORDER MARK!
Header MUST be sent before EVERYTHING in the page. Even a single space will break your script. In my case, there was BOM setted in the encoding, so I opened the file with notepad++ and set the encoding to UTF-8 (no BOM) and voila, everything is working great now.
Some versions of Internet Explorer (at least 6, 7, 8) have problems of downloading files over SSL, when using header "Content-Disposition: attachment; filename=[...]". To solve the problem set the following headers:
Expires: 0
Cache-Control: private
Pragma: cache
Also have a look at this:
http://drupal.org/node/163298
http://blog.pommesbude.org/archives/343-IE,-download-und-https.html
Many of the issues with headers can be solved quite quickly by using the following code before you set your headers:
<?php
headers_sent(&$file, &$line);
var_dump($file, $line);
?>
This will show you exactly where the first line of output is coming from, which will prevent your headers from being set.
Microsoft KB http://support.microsoft.com/kb/234067 strongly recommends to set up "expires" header for best cache control.
Everything else is workaround.
I had download error with first attempt always till i had cache-control header within script using Internet Explorer.
Such code works fine with IE 7-8:
<?php
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT\n");
header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
header("Content-type: application/zip;\n"); //or yours?
header("Content-Transfer-Encoding: binary");
$len = filesize($filename);
header("Content-Length: $len;\n");
$outname="downfile.zip";
header("Content-Disposition: attachment; filename=\"$outname\";\n\n");
readfile($filename);
?>
Just to inform you all, do not get confused between Content-Transfer-Encoding and Content-Encoding
Content-Transfer-Encoding specifies the encoding used to transfer the data within the HTTP protocol, like raw binary or base64. (binary is more compact than base64. base64 having 33% overhead).
Eg Use:- header('Content-Transfer-Encoding: binary');
Content-Encoding is used to apply things like gzip compression to the content/data.
Eg Use:- header('Content-Encoding: gzip');
If you want to remove a header and keep it from being sent as part of the header response, just provide nothing as the header value after the header name. For example...
PHP, by default, always returns the following header:
"Content-Type: text/html"
Which your entire header response will look like
HTTP/1.1 200 OK
Server: Apache/2.2.11 (Unix)
X-Powered-By: PHP/5.2.8
Date: Fri, 16 Oct 2009 23:05:07 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
If you call the header name with no value like so...
<?php
header( 'Content-Type:' );
?>
Your headers now look like this:
HTTP/1.1 200 OK
Server: Apache/2.2.11 (Unix)
X-Powered-By: PHP/5.2.8
Date: Fri, 16 Oct 2009 23:05:07 GMT
Connection: close
If you want PHP to generate your desired HTTP status code and corresponding phrase...
Thanks to the notification from guy.paddock AT gmail DOT com, I have accordingly changed the example inside my little page, in a way to respect the types of the parameters.
http://gif.phpnet.org/frederic/programs/http_status_codes/
I can repeat here an example:
<?php header('x', TRUE, 100); /* server will ouput: "HTTP/1.1 100 Continue" */ ?>
To be strict (actually PHP is rather tolerant) let us say:
- the first parameter has to be any NOT EMPTY string,
- the second parameter has to be a boolean, obviously it has to be TRUE, as it would be a nonsense to send several different status (anyway the server would not let you to do stupid things),
- the third parameter has to be an integer, between 100 and 599; an integer out of that range - or in range but of unknown value - will generate a
500 Internal Server Error
response.
I hope that helps ;)
If you want to ENABLE cache:
<?php
// seconds, minutes, hours, days
$expires = 60*60*24*14;
header("Pragma: public");
header("Cache-Control: maxage=".$expires);
header('Expires: ' . gmdate('D, d M Y H:i:s', time()+$expires) . ' GMT');
?>
I just want to add, becuase I see here lots of wrong formated headers.
1. All used headers have first letters uppercase, so you MUST follow this. For example:
Location, not location
Content-Type, not content-type or CONTENT-TYPE
2. Then there MUST be colon and space, like
good: header("Content-Type: text/plain");
wrong: header("Content-Type:text/plain");
3. Location header MUST be absolute uri with scheme, port and so on.
good: header("Location: http://www.example.com/something.php?a=1");
4. It cann't be relative:
wrong: Location: /something.php?a=1
wrong: Location: ?a=1
It will make proxy server and http clients happier.
For all the examples above:
I strongly recommend, that you use
header($_SERVER["SERVER_PROTOCOL"]." 404 Not Found");
instead of
header("HTTP/1.1 404 Not Found");
I had big troubles with an Apache/2.0.59 (Unix) answering in HTTP/1.0 while I (accidentially) added a "HTTP/1.1 200 Ok" - Header.
Most of the pages were displayed correct, but on some of them apache added weird content to it:
A 4-digits HexCode on top of the page (before any output of my php script), seems to be some kind of checksum, because it changes from page to page and browser to browser. (same code for same page and browser)
"0" at the bottom of the page (after the complete output of my php script)
It took me quite a while to find out about the wrong protocol in the HTTP-header.
For who likes to know all the status codes, and the corresponding phrases, that PHP can generate when using the $http_response_code param in the header() function, I have made a little script which tries sequentially all the codes from 100 to 599 and keeps those generating valid results.
This script is enough long to process (using a socket loop connection) then it is executed actually once a day, but generates a cache file, to be served fast.
Note that here are the codes generated by PHP, not those which can be answered by Apache or any other server, nor any other 'exotic' status codes specific to some application: http://gif.phpnet.org/frederic/programs/http_status_codes/
I've just discovered that Chrome doesn't perform a Location: instruction unless it gets a Status: first. It's also sensitive to capitalisation.
<?php
header("Status: 200");
header("Location: /home.php");
exit;
?>
Here is a php script I wrote to stream a file and crypt it with a xor operation on the bytes and with a key :
The encryption works very good but the speed is decrease by 2, it is now 520KiB/s. The user is now asked for a md5 password (instead of keeping it in the code directly). There is some part in French because it's my native language so modify it as you want.
<?php
// Stream files and encrypt the data on-the-fly
// Settings
// -- File to stream
$file = "FILE_out";
// -- Reading buffer
$bufferlength = 3840;
// -- Key in hex
//$keychar = "9cdfb439c7876e703e307864c9167a15";
// Function: Convertion hex key in a string into binary
function hex2bin($h) {
if (!is_string($h)) return null;
$r = array();
for ($a=0; ($a*2)<strlen($h); $a++) {
$ta = hexdec($h[2*$a]);
$tb = hexdec($h[(2*$a+1)]);
$r[$a] = (int) (($ta << 4) + $tb);
}
return $r;
}
// Function to send the auth headers
function askPassword($text="Enter the password") {
header('WWW-Authenticate: Basic realm="'. utf8_decode($text) .'"');
header('HTTP/1.0 401 Unauthorized');
return 1;
}
// Key is asked at the first start
if (!isset($_SERVER['PHP_AUTH_PW'])) {
askPassword();
echo "Une clé est nécessaire !<br />";
exit;
}
// Get the key in hex
$keychar = $_SERVER['PHP_AUTH_PW'];
// Convert key and set the size of the key
$key = hex2bin($keychar);
$keylength = count($key);
// Teste si la clé est valide en hex
if ($key == "" || $keylength <= 4) {
askPassword("Clé incorrecte !");
//echo "Clé incorrecte !<br />";
exit();
}
// Teste si la clé est de longueur d'une puissance de 2
if ( ($keylength%2) != 0) {
askPassword("Clé de longueur incorrecte (multiple de 2 uniquement)");
//echo "Clé de longueur incorrecte (puissance de 2 uniquement)<br />";
exit();
}
// Headers
header("Content-Type: application/octet-stream; ");
header("Content-Transfer-Encoding: binary");
header("Content-Length: " . filesize($file) ."; ");
header("filename=\"".$file."\"; ");
flush(); // this doesn't really matter.
// Opening the file in read-only
$fp = fopen($file, "r");
while (!feof($fp))
{
// Read a buffer size of the file
$buffer = fread($fp, $bufferlength);
$j=0;
for ($i=0; $i < $bufferlength; $i++) {
// The key is read in loop to crypt the whole file
if ($i%$keylength == 0) {
$j=0;
}
// Apply a xor operation between the key and the file to crypt
// This operation eats a lots of CPU time (Stream at 1MiB/s on my server; Intel E2180)
$tmp = pack("C", $key[$j]);
$bufferE = ( $buffer[$i]^$tmp); // <==== Le fameux XOR
/*
echo "<br />key[".$j."]: ";
var_dump($tmp);
echo "<br />buffer[".$i."]: ";
var_dump($buffer[$i]);
echo "<br />bufferE: ";
var_dump($bufferE);
echo "<br />";
//*/
// Send the encrypted data
echo $bufferE;
// Clean the memory
$bufferE = "";
$j++;
}
$buffer = "";
flush(); // this is essential for large downloads
/*
fclose($fp);
exit();
//*/
}
// Close the file and it's finished
fclose($fp);
?>
WARNING:
In order to make Internet Explorer 6 (probably also 7) not to cache pages you should use only these headers:
header("Cache-Control: no-cache");
header("Expires: -1");
as suggested by Microsoft itself [source: http://support.microsoft.com/kb/234067]
if you add all the headers suggested in "Example #2 Caching directives" above:
header("Cache-Control: no-cache, must-revalidate");
header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");
IE browser goes on CACHING THE PAGE!!!
I ran into problems when trying to get php to use a transparent ErrorDocument redirect.
My document root .htaccess was set up to redirect select error codes to error.php which tests against $_SERVER['REDIRECT_STATUS'] and templates a document based on the status code.
I had hoped to raise a 404 after a mysql query turned up empty (fyi; before output had started) but page output continued "normally", ie incorrectly.
Because this was inside a template class I was able to manually change the template's include file and $_SERVER['REDIRECT_STATUS'] to output the desired result. I wasn't actually sure if header() worked or not because apache2 has already returned 200 OK after which any header change would only affect the browser, wouldn't it?
I have read about header() working with apache redirects before, is this still available with apache2? Here's some code just to explain the concept:
<?php
class page_template
{
$include_file;
//...
function getData ()
{
try {
//...
if ($result->num_rows == 0) {
throw new MysqlException("Empty result set");
}
//...
} catch (MysqlException $e) {
if ($e->getMessage() == "Empty result set") {
header("HTTP/1.0 404 Not Found");
header("Status: 404 Not Found");
//the below two lines fixed the issue for me
$_SERVER['REDIRECT_STATUS'] = 404;
$this->template_file = $_SERVER['DOCUMTENT_ROOT'].'error.php';
}
}
}
?>
When you are trying to download a file using PHP it´s important to take into acount the definition of de Header element.
I have seen various examples where the people use a
<?php
header("Content-Type: application/octet-stream");
header("Content-Disposition: attachment; filename=\"".$filename."\";");
?>
however in adition to this is important add the definition of the cache because if you dont do it you will have problems with some navigators for example IE 7.0 under https protocol will show you a message saying that the file is not available.
here is a working example:
<?php
header("Pragma: public");
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Cache-Control: private",false);
header ( "Content-Type: $filedatatype" );
header("Content-Disposition: attachment; filename=\"".$FileObj->name."\";");
header("Content-Transfer-Encoding: binary");
header("Content-Length: ".$filesize);
readfile($file);
exit;
?>
where $filedatatype is the data type of the file for example:
application/pdf
If using header in Safari, make sure you use complete pahge names. For example, we were using
<?php
header("Location: ?mng=" . $_GET['mng']);
?>
but it didnt work in Safari so we are using this
<?php
header("Location: index.php?mng=" . $_GET['mng']);
?>
If using the 'header' function for the downloading of files, especially if you're passing the filename as a variable, remember to surround the filename with double quotes, otherwise you'll have problems in Firefox as soon as there's a space in the filename.
So instead of typing:
<?php
header("Content-Disposition: attachment; filename=" . basename($filename));
?>
you should type:
<?php
header("Content-Disposition: attachment; filename=\"" . basename($filename) . "\"");
?>
If you don't do this then when the user clicks on the link for a file named "Example file with spaces.txt", then Firefox's Save As dialog box will give it the name "Example", and it will have no extension.
See the page called "Filenames_with_spaces_are_truncated_upon_download" at
http://kb.mozillazine.org/ for more information. (Sorry, the site won't let me post such a long link...)
The encoding of a file is discovered by the Content-Type, either in the HTML meta tag or as part of the HTTP header. Thus, the server and browser does not need - nor expect - a Unicode file to begin with a BOM mark. BOMs can confuse *nix systems too. More info at http://unicode.org/faq/utf_bom.html#bom1
On another note: Safari can display CMYK images (at least the OS X version, because it uses the services of QuickTime)
For large files (100+ MBs), I found that it is essential to flush the file content ASAP, otherwise the download dialog doesn't show until a long time or never.
<?php
header("Content-Disposition: attachment; filename=" . urlencode($file));
header("Content-Type: application/force-download");
header("Content-Type: application/octet-stream");
header("Content-Type: application/download");
header("Content-Description: File Transfer");
header("Content-Length: " . filesize($file));
flush(); // this doesn't really matter.
$fp = fopen($file, "r");
while (!feof($fp))
{
echo fread($fp, 65536);
flush(); // this is essential for large downloads
}
fclose($fp);
?>
Set a fast ETAG:
<?php
$fp = fopen($_SERVER["SCRIPT_FILENAME"], "r");
$etag = md5(serialize(fstat($fp)));
fclose($fp);
header('Etag: '.$etag);
?>
It is important to note that headers are actually sent when the first byte is output to the browser. If you are replacing headers in your scripts, this means that the placement of echo/print statements and output buffers may actually impact which headers are sent. In the case of redirects, if you forget to terminate your script after sending the header, adding a buffer or sending a character may change which page your users are sent to.
This redirects to 2.html since the second header replaces the first.
<?php
header("location: 1.html");
header("location: 2.html"); //replaces 1.html
?>
This redirects to 1.html since the header is sent as soon as the echo happens. You also won't see any "headers already sent" errors because the browser follows the redirect before it can display the error.
<?php
header("location: 1.html");
echo "send data";
header("location: 2.html"); //1.html already sent
?>
Wrapping the previous example in an output buffer actually changes the behavior of the script! This is because headers aren't sent until the output buffer is flushed.
<?php
ob_start();
header("location: 1.html");
echo "send data";
header("location: 2.html"); //replaces 1.html
ob_end_flush(); //now the headers are sent
?>
You can use HTTP's etags and last modified dates to ensure that you're not sending the browser data it already has cached.
<?php
$last_modified_time = filemtime($file);
$etag = md5_file($file);
header("Last-Modified: ".gmdate("D, d M Y H:i:s", $last_modified_time)." GMT");
header("Etag: $etag");
if (@strtotime($_SERVER['HTTP_IF_MODIFIED_SINCE']) == $last_modified_time ||
trim($_SERVER['HTTP_IF_NONE_MATCH']) == $etag) {
header("HTTP/1.1 304 Not Modified");
exit;
}
?>
Note that if you don't want to go through the process of making sure that there is no output before you send a header, you can use
<?php
ob_start();
?>
at the beginning of your page.
This starts the output buffer, which allows you to send headers whenever you feel like it. Make sure that you put it at the BEGINNING, after the first php tag.
It allows you to do something like
<?php
ob_start();
echo 'foo';
header("Status: 404 Not Found");
echo 'bar';
?>
if you use php to create custom error pages (such as header('HTTP/1.1 500 Internal Server Error');) Internet Explorer ignores you custom page unless it is at least 512 (or sometimes 1024 bytes)
IE ignores custom error pages that are less than 512 (or from what i've read 1024) bytes.
just place this before any output on your custom error page--- and be sure that your custom error page includes proper html tags (it must have a </body> for this specific example to work)
<?php
// set your custom error header --- example --- header('HTTP/1.1 503 Service Unavailable');
function padding($html){
return ($padding=1024-ob_get_length()) > 0 ? str_replace('</body>','<!--'. ($padding>8?str_repeat(' ',$padding-8) :null ).'-->'."\n".'</body>',$html) : $html;
}
ob_start('padding');
?>
and then place this somewhere within the html error page output
<!-- ---- -->
that will auto-adjust to pad the file to 1024 bytes to override the default Internet Explorer error pages.
To get PHP to load a PDF (for example) from file, use the following code.
<?php
$filename = $_SERVER['DOCUMENT_ROOT'] . "/path/to/file/my_file.pdf";
header("Cache-Control: public");
header("Content-Description: File Transfer");
header('Content-disposition: attachment; filename='.basename($filename));
header("Content-Type: application/pdf");
header("Content-Transfer-Encoding: binary");
header('Content-Length: '. filesize($filename));
readfile($filename);
?>
These functions turn on SSL, and turn off SSL. The Redirect function is also good to use for all redirects... tries PHP, then Java, then HTML for redirects.
Here are the improved functions... had an error in the one I posted yesterday if you guys could please delete that one.
<?php
//This works in 5.2.3
//First function turns SSL on if it is off.
//Second function detects if SSL is on, if it is, turns it off.
//==== Redirect... Try PHP header redirect, then Java redirect, then try http redirect.:
function redirect($url){
if (!headers_sent()){ //If headers not sent yet... then do php redirect
header('Location: '.$url); exit;
}else{ //If headers are sent... do java redirect... if java disabled, do html redirect.
echo '<script type="text/javascript">';
echo 'window.location.href="'.$url.'";';
echo '</script>';
echo '<noscript>';
echo '<meta http-equiv="refresh" content="0;url='.$url.'" />';
echo '</noscript>'; exit;
}
}//==== End -- Redirect
//==== Turn on HTTPS - Detect if HTTPS, if not on, then turn on HTTPS:
function SSLon(){
if($_SERVER['HTTPS'] != 'on'){
$url = "https://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
redirect($url);
}
}//==== End -- Turn On HTTPS
//==== Turn Off HTTPS -- Detect if HTTPS, if so, then turn off HTTPS:
function SSLoff(){
if($_SERVER['HTTPS'] == 'on'){
$url = "http://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
redirect($url);
}
}//==== End -- Turn Off HTTPS
?>
Hi,
I was trying to save the '.xls' on user machine, which works correctly on
Firefox(developer friendly) but not on Microsoft's IE(Microsoft friendly);
after searching on the net, i found this code which works on both the browser.
Source link: http://www.webdeveloper.com/forum/archive/index.php/t-30248.html
here is the code:
-------------------------
<?php
// downloading a file
$filename = $_GET['path'];
// fix for IE catching or PHP bug issue
header("Pragma: public");
header("Expires: 0"); // set expiration time
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
// browser must download file from server instead of cache
// force download dialog
header("Content-Type: application/force-download");
header("Content-Type: application/octet-stream");
header("Content-Type: application/download");
// use the Content-Disposition header to supply a recommended filename and
// force the browser to display the save dialog.
header("Content-Disposition: attachment; filename=".basename($filename).";");
/*
The Content-transfer-encoding header should be binary, since the file will be read
directly from the disk and the raw bytes passed to the downloading computer.
The Content-length header is useful to set for downloads. The browser will be able to
show a progress meter as a file downloads. The content-lenght can be determines by
filesize function returns the size of a file.
*/
header("Content-Transfer-Encoding: binary");
header("Content-Length: ".filesize($filename));
@readfile($filename);
exit(0);
?>
If you are looking to send files such as PDFs or Excel spreadsheets or Microsoft Office documents and are having issues with IE7, IE6, or IE5.5 not being able to open/download the files over an SSL connection, but still need not allow caching, then set these two headers:
<?php
header("Cache-Control: maxage=1"); //In seconds
header("Pragma: public");
?>
Granted, this will cache your file for one second, but it's as close to an un-cached download as you can get when using IE over SSL.
Some basic info on the issue can be found here: http://support.microsoft.com/kb/812935
If you come across cache error (when trying to cache your images or other files) like this:
[code=CACHE_FILL_OPEN_FILE] An internal error prevented the object from being sent to the client and cached. Try again later.
You may try sending Cache-Control: private header at the beginning to sort that out
header('Cache-Control: private');
If you have Apache, you can setup your ErrorDocument to point
to a php file that instructs search engines to try again in 120 seconds.
This can be helpful when you are doing maintenance on the site.
Then in .htaccess
ErrorDocument 503 /cgi-bin/503.php
ErrorDocument 500 /cgi-bin/503.php
<?php
ob_start();
@header("HTTP/1.1 503 Service Temporarily Unavailable");
@header("Status: 503 Service Temporarily Unavailable");
@header("Retry-After: 120");
@header("Connection: Close");
?><!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>503 Service Temporarily Unavailable</title>
</head><body>
<h1>Service Temporarily Unavailable</h1>
<p>The server is temporarily unable to service your
request due to maintenance downtime or capacity
problems. Please try again later.</p>
</body></html><?php
$g=ob_get_clean();
echo $g;
exit;
exit();
?>
See:
http://askapache.com/htaccess/503-service-temporarily-unavailable.html
I've been having trouble with a simple page that simply redirects the page elsewhere. Even the simple:
<?php
Header("Location: http://www.google.com/");
?>
Wouldn't work ("Warning: Headers already sent!").
After double checking for extra spaces, I found out that because I saved the file as a UTF-8 file, and the page wasn't loaded as a UTF-8 page, so some weird character was prepended to the page. After saving the file as a windows-1252 file it worked ok. Hope this someone some headaches.
if you are planing to make a download script like this one:
<?php
$mm_type="application/octet-stream";
header("Cache-Control: public, must-revalidate");
header("Pragma: hack");
header("Content-Type: " . $mm_type);
header("Content-Length: " .(string)(filesize($fullpath)) );
header('Content-Disposition: attachment; filename="'.$filename.'"');
header("Content-Transfer-Encoding: binary\n");
readfile($fullpath);
?>
you will notice that the zip files becomes invalid after download, thats because all files downloaded starts with empty line which is a problem for the zip files
This can be fixed with adding ob_start() at the beginning of the script and od_end_clean() just before the readfile()
Is there a serious problem with utf8 encoding?
Answer: no- utf8 with bom is a problem..
I spent about 10 hours trying every tip or fix suggested by users to fix the problem with " headers already sent ".
Finally I found the problem with a hex editor.
As it is previously mentioned header() should be the first statement. Moreover php opening and closing tags should be clean of spaces:
So something like this should work:
<?php
header('something ..');
?>
I had applied an authentication scheme to my pages using sessions. The encoding of my files was "utf-8". Though I
tried cleaning everything about spaces,tabs and other dirt through my code, I kept getting these " headers already sent errors..". The problem was in utf-8 encoding ( I don't mean the meta:http-equiv=" charset='utf-8' tag but the actual encoding of my file.) When I changed to ANSI everything worked. Actually the utf-8 encoding added three characters at the start of my file : ο»Ώ. This is called bom in utf-8. So if you are going to use utf-8 encodings to your pages and need to put php header code in these pages choose to save "utf8 without bom". (I hope your editor has such an option - I use notepad++ in win32 )
Hope it helps..
The first element of the header (i.e. "Location") is case sensitive depending on the browser. In IE7, <?php header("location:http://www.url.com"); ?> does not work as expected whereas <?php header ("Location:http://www.ulr.com"); ?> does work as expected.
For a full list of headers and their values go here: http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html
If you want your download script to work in Safari you'll have to print quotation marks around the filename:
header('Content-Disposition: attachment; filename="'.$fileName.'"');
,otherwise Safari will just save the file as 'scriptname.php'.
I recently had a hair-threatening problem with Firefox and XHTML 1.0 transitional.
It worked fine with other browsers, and also with HTML 4.1.
To cut a long story short, PHP-generated JS and CSS files were still being reported by the headers as text/html, while in the HTML they were text/css and application/javascript; Firefox having been told the page was XHTML 1.0 became anal-retentive and refused to style the page. (I think the JS still worked but I fixed it anyway.)
Solution:
header('Content-type: text/css');
and
header('Content-type: application/javascript');
A quick way to make redirects permanent or temporary is to make use of the $http_response_code parameter in header().
<?php
// 301 Moved Permanently
header("Location: /foo.php",TRUE,301);
// 302 Found
header("Location: /foo.php",TRUE,302);
header("Location: /foo.php");
// 303 See Other
header("Location: /foo.php",TRUE,303);
// 307 Temporary Redirect
header("Location: /foo.php",TRUE,307);
?>
The HTTP status code changes the way browsers and robots handle redirects, so if you are using header(Location:) it's a good idea to set the status code at the same time. Browsers typically re-request a 307 page every time, cache a 302 page for the session, and cache a 301 page for longer, or even indefinitely. Search engines typically transfer "page rank" to the new location for 301 redirects, but not for 302, 303 or 307. If the status code is not specified, header('Location:') defaults to 302.
I strongly recommend the "Live HTTP Headers" plugin for Firefox for any work when manually setting headers. (Find it in the addons section on mozilla.com) This allows you to see the headers your PHP script and server are sending, plus Firefox's request headers.
One important thing to note is a conflict with many of the scripts here, including in lasitha dot alawatta's Excel post just a few below me, is that sending multiple headers of the same type from your script does not actually cause multiple lines of output to the browser, at least for the version of PHP5 I'm running, and it's doubtful the browser would process any other than the last line anyhow.
So sending multiple "Pragma: " or "Cache-Control: " headers results in only the last one set in your script to actually be sent.
Also, it's already been pointed out, but setting "Cache-Control: Pre-Check=0, Post-Check=0" does absolutely nothing. I believe only MSIE even uses these values and it specifically IGNORES both of them when both are set to zero.
I've actually had more trouble trying to encourage caching than preventing it, because PHP sends "Cache-Control" and "Pragma" headers either always or at least always with sessions on (and I always have sessions on). The trick is to always send BOTH "Cache-Control" and "Pragma" because if they conflict it's completely up to the browser to resolve. And if you have a custom server in PHP like I'm working on right now, you'll need to sniff for $_SERVER['IF-MODIFIED-SINCE'] and serve up "HTTP/1.1 304 Not Modified" as appropriate.
If you are doing something like this and want to ensure caching of static files, the best way I found was to give an honest "Last-Modified", set an "Expires:" a reasonable time in the future (a few minutes through the year 2038, depending on what you're doing), set "Cache-Control" to "private" or "public", and stay away from "Max-Age".
I spent a long time trying to determine why Internet Explorer 7 wasn't prompting the user to save a download based on the filename specified on a "'Content-Disposition: attachment; filename=..." header line.
I eventually determined that my Apache installation was adding an additional header: "Vary: Host", which was throwing IE - as per http://support.microsoft.com/kb/824847
I found manually setting the Vary header from within PHP as follows header('Vary: User-Agent'); allowed IE to behave as intended.
Hope this saves someone else some time,
- Kal
Create MS-Excel file:
<?php
$export_file = "my_name.xls";
ob_end_clean();
ini_set('zlib.output_compression','Off');
header('Pragma: public');
header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); // Date in the past
header('Last-Modified: '.gmdate('D, d M Y H:i:s') . ' GMT');
header('Cache-Control: no-store, no-cache, must-revalidate'); // HTTP/1.1
header('Cache-Control: pre-check=0, post-check=0, max-age=0'); // HTTP/1.1
header ("Pragma: no-cache");
header("Expires: 0");
header('Content-Transfer-Encoding: none');
header('Content-Type: application/vnd.ms-excel;'); // This should work for IE & Opera
header("Content-type: application/x-msexcel"); // This should work for the rest
header('Content-Disposition: attachment; filename="'.basename($export_file).'"');
?>
If you are finding that header() is not working for no obvious reason, make use of the headers_sent() function to drill down to the cause of the problem.
Consider the following scenario,
<?php
// Sign out
signOut();
// Redirect back to the main page
header("Location: http://mysite.com/mainpage");
?>
If for some reason, the header() call to redirect is not working, there won't be any error messages, making it difficult to debug. However, using headers_sent(), you may easily find the source of the problem.
<?php
// Sign out
signOut();
/*
* If headers were already sent for some reason,
* the upcoming call to header() will not work...
*/
if(headers_sent($file, $line)){
// ... where were the mysterious headers sent from?
echo "Headers were already sent in $file on line $line...";
}
// Redirect back to the main page
header("Location: http://mysite.com/mainpage");
?>
As the documentation states, "header() must be called before any actual output is sent, either by normal HTML tags, blank lines in a file, or from PHP." In the above debugging solution, you will find out exactly where any of these problematic output or blank lines exist. You should then be able to resolve the issues with much more ease than if you hunted for the problems aimlessly.
In case anyone else is having trouble:
using a web-server behind the pound load balancer, we found that trying to redirect to https://example.com for requests to http://example.com were getting into an infinite loop because pound, by default, 'fixes' changes of protocol for you. You want to set RewriteLocation to 0 to turn this behaviour off.
This is the Headers to force a browser to use fresh content (no caching) in HTTP/1.0 and HTTP/1.1:
<?PHP
header( 'Expires: Sat, 26 Jul 1997 05:00:00 GMT' );
header( 'Last-Modified: ' . gmdate( 'D, d M Y H:i:s' ) . ' GMT' );
header( 'Cache-Control: no-store, no-cache, must-revalidate' );
header( 'Cache-Control: post-check=0, pre-check=0', false );
header( 'Pragma: no-cache' );
?>
You can use the Header command to force a browser to use fresh content (no caching).
However, this only works for the HTML code your code generates. When you have updated images for example (with the same filename) then there's a chance that these are still cached.
The easiest way to solve this problem I found is changing:
<?php
print "<img src='yourfile.jpg'>";
?>
into:
<?php
print "<img src='yourfile.jpg?".time()."'>";
?>
This adds an unique number to the url and wont hurt at all.
More on downloading files...
Here's a slight improvement to the method provided by Nick Sterling.
I tried this and it works great, but using fopen ran into memory limit problems.
By using readfile($filename), I solved this problem without having to change the ini settings.
readfile() reads a file and writes it to the output buffer.
Here's my version of the code:
<?php
$filename = "theDownloadedFileIsCalledThis.mp3";
$myFile = "/absolute/path/to/my/file.mp3";
$mm_type="application/octet-stream";
header("Cache-Control: public, must-revalidate");
header("Pragma: hack"); // WTF? oh well, it works...
header("Content-Type: " . $mm_type);
header("Content-Length: " .(string)(filesize($myFile)) );
header('Content-Disposition: attachment; filename="'.$filename.'"');
header("Content-Transfer-Encoding: binary\n");
readfile($myFile);
?>
As an alternative to using header('Content-Type: ****') on almost every page, the default Content-Type (and character set, too, if needed) can be set in php.ini under the "default_mimetype" and "default_charset" entries.
Careful! This line of code cause IIS to crash on PHP 4.3.4 and maybe others.
<?php
header("location:/currentfile.php");
// forward slash causes crash
// currentfile.php is the exact basename of this file
?>
Learned this the hard way.
When messing with custom headers, it is extremely helpful to make sure that they are actually sent to the server. Nothing is more frustrating than discovering that some custom header was improperly formatted or not sent at all. There is an Internet Explorer add-in called ieHTTPHeaders that I've found to be immensely useful:
http://www.blunck.info/iehttpheaders.html
Firefox (and Mozilla) users can use an equivalent tool/plugin called LiveHTTPHeaders:
http://livehttpheaders.mozdev.org/
If you are trying to send image data to a mobile phone from PHP, some models (Motorola RAZOR V3 on Cingular) for whatever reason require the "Last-Modified" header or they will not show the image.
<?php
ob_start();
// assuming you have image data in $imagedata
$length = strlen($imagedata);
header('Last-Modified: '.date('r'));
header('Accept-Ranges: bytes');
header('Content-Length: '.$length);
header('Content-Type: image/jpeg');
print($imagedata);
ob_end_flush();
?>
date('r') produces the date with the numeric timezone offset (-0400) versus Apache, which uses timezone names (GMT), but according to the HTTP/1.1 RFC, dates should be formatted by RFC 1123 (RFC 822) which states: "There is a strong trend towards the use of numeric timezone indicators, and implementations SHOULD use numeric timezones instead of timezone names. However, all implementations MUST accept either notation." (http://www.ietf.org/rfc/rfc1123.txt)
apache_request_headers() is only available if PHP is running as an apache module. Various request header values are available in the $_SERVER array, for example:
$_SERVER["HTTP_IF_MODIFIED_SINCE"]
Gives the if modified date in "Sat, 12 Aug 2006 19:12:08 GMT" format.
When using HTML forms, using the browser's back button will sometimes display a message regarding using cached data, and will ask you to refresh the page. This can be very disconcerting for some users, as they might not know whether to hit Refresh or not.
To force pages to always load the data that was entered in the form prior to hitting a submit button, and prevent the browser's cache message from displaying, use the following code:
<?php
// Original code found at http://www.mnot.net/cache_docs/
header("Cache-Control: must-revalidate");
$offset = 60 * 60 * 24 * -1;
$ExpStr = "Expires: " . gmdate("D, d M Y H:i:s", time() + $offset) . " GMT";
header($ExpStr);
?>
This will tell the browser that the page will expire in one day, and the cached form data will be used without prompting the user at all.
I have tested this in Internet Explorer 6, Firefox 1.5, and Opera 8.51, and it works as intended. I have tried other cache-control and expiry variants, but they either do not work, or do not work in every browser. This code appears to be a winner.
Constructing an absolute URL (for redirecting or other purposes) is full of pitfalls. As well as considering the notes at http://www.php.net/manual/en/function.header.php#63006 and http://www.php.net/manual/en/function.header.php#61746 you need to consider this issue, applicable if you use ProxyPass (in apache).
Example httpd.conf
...
ProxyPass /dir/ http: //10.1.1.1/dir/
...
Member of public ---> Unix/Apache server ---> IIS/PHP server
http: //nick.com/ nick.com myphpsvr.nick.com
dir/phpinfo.php 20.10.5.1 10.1.1.1
When your script is on the IIS/PHP server, browsing from member of public, you will have script variables
<?php
// browsing from member of public
$_SERVER['HTTP_HOST'] == '10.1.1.6';
$_SERVER['HTTP_X_FORWARDED_HOST'] == 'nick.com';
$_SERVER['SERVER_NAME'] == '10.1.1.6';
?>
However, if you browse internally (like, when testing, http: //myphpsrv.nick.com/dir/phpinfo.php), the variables turn out like this
<?php
// browsing from internal, direct
$_SERVER['HTTP_HOST'] == 'myphpsvr.nick.com';
$_SERVER['SERVER_NAME'] == 'myphpsvr.nick.com';
// no $_SERVER['HTTP_X_FORWARDED_HOST']
?>
The point is, you need to test $_SERVER['HTTP_X_FORWARDED_HOST'] and use that in preference to either $_SERVER['HTTP_HOST'] or $_SERVER['SERVER_NAME'].
Nick Bishop.
URL's have intentionally been broken up to stop them being clickable.
When using PHP to output an image, it won't be cached by the client so if you don't want them to download the image each time they reload the page, you will need to emulate part of the HTTP protocol.
Here's how:
<?php
// Test image.
$fn = '/test/foo.png';
// Getting headers sent by the client.
$headers = apache_request_headers();
// Checking if the client is validating his cache and if it is current.
if (isset($headers['If-Modified-Since']) && (strtotime($headers['If-Modified-Since']) == filemtime($fn))) {
// Client's cache IS current, so we just respond '304 Not Modified'.
header('Last-Modified: '.gmdate('D, d M Y H:i:s', filemtime($fn)).' GMT', true, 304);
} else {
// Image not cached or cache outdated, we respond '200 OK' and output the image.
header('Last-Modified: '.gmdate('D, d M Y H:i:s', filemtime($fn)).' GMT', true, 200);
header('Content-Length: '.filesize($fn));
header('Content-Type: image/png');
print file_get_contents($fn);
}
?>
That way foo.png will be properly cached by the client and you'll save bandwith. :)
If you want to enable caching of your page, you have two solutions: use Etag or use Last-Modified.
Someone has already posted here the code to use Etag. However, sometimes, it is easier (better) to use Last-Modified. The full code is here:
<?php
function get_http_mdate()
{
return gmdate("D, d M Y H:i:s",filemtime($SCRIPT_FILENAME))." GMT";
}
function check_modified_header()
{
// This function is based on code from http://ontosys.com/php/cache.html
$headers=apache_request_headers();
$if_modified_since=preg_replace('/;.*$/', '', $headers['If-Modified-Since']);
if(!$if_modified_since)
return;
$gmtime=get_http_mdate();
if ($if_modified_since == $gmtime) {
header("HTTP/1.1 304 Not Modified");
exit;
}
}
check_modified_header();
header("Last-Modified: ".get_http_mdate());
?>
The script checks if time from "If-Modified-Since" header is equal to current modified-time. If it is, a 304 code is returned, and PHP exits. If it is not, PHP continues normally.
You may want to change how "get_http_mdate()" function gets the time. You may want to get time from another file, or from somewhere else (like a date field on database).
I just made a function to allow a file to force-download (for a script to disallow file links from untrusted sites -- preventing mp3/video leeching on forums), and I realized that a script like that could potentially be very dangerous.
Someone could possibly exploit the script to download sensitive files from your server, like your index.php or passwords.txt -- so I made this switch statement to both allow for many file types for a download script, and to prevent certain types from being accessed.
<?php
function dl_file($file){
//First, see if the file exists
if (!is_file($file)) { die("<b>404 File not found!</b>"); }
//Gather relevent info about file
$len = filesize($file);
$filename = basename($file);
$file_extension = strtolower(substr(strrchr($filename,"."),1));
//This will set the Content-Type to the appropriate setting for the file
switch( $file_extension ) {
case "pdf": $ctype="application/pdf"; break;
case "exe": $ctype="application/octet-stream"; break;
case "zip": $ctype="application/zip"; break;
case "doc": $ctype="application/msword"; break;
case "xls": $ctype="application/vnd.ms-excel"; break;
case "ppt": $ctype="application/vnd.ms-powerpoint"; break;
case "gif": $ctype="image/gif"; break;
case "png": $ctype="image/png"; break;
case "jpeg":
case "jpg": $ctype="image/jpg"; break;
case "mp3": $ctype="audio/mpeg"; break;
case "wav": $ctype="audio/x-wav"; break;
case "mpeg":
case "mpg":
case "mpe": $ctype="video/mpeg"; break;
case "mov": $ctype="video/quicktime"; break;
case "avi": $ctype="video/x-msvideo"; break;
//The following are for extensions that shouldn't be downloaded (sensitive stuff, like php files)
case "php":
case "htm":
case "html":
case "txt": die("<b>Cannot be used for ". $file_extension ." files!</b>"); break;
default: $ctype="application/force-download";
}
//Begin writing headers
header("Pragma: public");
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Cache-Control: public");
header("Content-Description: File Transfer");
//Use the switch-generated Content-Type
header("Content-Type: $ctype");
//Force the download
$header="Content-Disposition: attachment; filename=".$filename.";";
header($header );
header("Content-Transfer-Encoding: binary");
header("Content-Length: ".$len);
@readfile($file);
exit;
}
?>
This works in both IE and Firefox.
One that tripped me up for a while...
When I use PHP sessions, the following headers are sent automatically to force the browser not to cache:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
If you are having trouble with inline PDFs etc., thses may be causing you problems. As per other notes here if you overwrite these headers before outputting your file, the download problems will go away.
header('Cache-Control:');
header('Pragma:');
If you wish to retain the dynamic content, only send the above if the document you are returning is not HTML.
Its well worth examining your own headers (call your PHP script from another script using get_headers() for instance) before going mad trying to fix something - better still compare the headers from your script with headers from a static web page - it might save you hours of time.
some browsers always reload stylesheets, javascripts and other seldomnly changing files, which causes nasty delays when loading a website (Safari on MacOS is an example)
to tell the browser to keep files in cache for at least a day, you can use
<?php
header('Expires: ' . gmdate('D, d M Y H:i:s', time()+24*60*60) . ' GMT');
?>
This has the nice sideeffect of telling other browser that never refresh pages to refresh them at least once a day.
PS: i figure this is trivial, but it cost me some headache
How to force browser to use already downloaded and cached file.
If you have images in DB, they will reload each time user views them. To prevent this, web server must identify each file with ID.
When sending a file, web server attaches ID of the file in header called ETag.
header("ETag: \"uniqueID\");
When requesting file, browser checks if the file was already downloaded. If cached file is found, server sends the ID with the file request to server.
Server checks if the IDs match and if they do, sends back
header("HTTP/1.1 304 Not Modified");
else
Server sends the file normally.
<?php
$file = getFileFromDB();
// generate unique ID
$hash = md5($file['contents']);
$headers = getallheaders();
// if Browser sent ID, we check if they match
if (ereg($hash, $headers['If-None-Match']))
{
header('HTTP/1.1 304 Not Modified');
}
else
{
header("ETag: \"{$hash}\"");
header("Accept-Ranges: bytes");
header("Content-Length: ".strlen($file['content']));
header("Content-Type: {$mime}");
header("Content-Disposition: inline; filename=\"{$file['filename']}\";");
echo $file['content'];
}
exit();
?>
Is Unicode, UTF-8 and setcookie, session_start at the same time impossible...?
Well, then you might need this...:
1) Keep your source files in ASCII to avoid the Byte Order Mark (BOM) confusion hell when include'ing or require'ing multiple files and avoid cookies not working because of the "header already sent" thing..
2) use this source:
-------->
<?php
header('Content-Type: text/html; charset=utf-8');
header('Set-Cookie: track=978268624934537');
?>
<html>
<head>
<meta http-equiv=Content-Type content="text/html; charset=utf-8" />
<--------
Output through Apache to the browser will be UTF-8 and does not require browser to get page twice and the cookie works.
Your Chinese or cyrillic characters will work and come on out right too, provided you make an input script to put them into mysql using this scheme too.
Seems to me to be the way to use utf-8 with cookies. I hope you like it.
Peter Sierst Nielsen
A call to session_write_close() before the statement
<?php
header("Location: URL");
exit();
?>
is recommended if you want to be sure the session is updated before proceeding to the redirection.
We encountered a situation where the script accessed by the redirection wasn't loading the session correctly because the precedent script hadn't the time to update it (we used a database handler).
JP.
If you are using a redirect to an ErrorDocument, you may want to prefix your output with header("HTTP/1.0 200 OK"); to make sure automated clients don't think your file wasn't found.
This is a heads-up not just for php, but for any method of creating a 302 redirect. Mac IE 5.1.4 (osx) has a serious bug when it comes to the 302.
Say you have a form post page A with action pointing to a submit page B, and the submit page B processes and sends a 302 redirect back to the form page A. All works fine with that part. Now hit refresh while on page A, and the last form POST is suddenly delivered to page A!
This can be a very confusing bug to deal with, depending on how your code handles incoming post data. It could also be potentially very dangerous in terms of data loss, if it occurs within database administration pages (where I ran into it). What you may want to do is plan your site so that the form page itself never needs to read POST data, and then ignore all POST data. Either that, or in the location url from your header function add a query argument such as "nopost=1" which, when present, indicates to your page A code to ignore the POST data.
I've tested with Firebird Mac/PC, and IE6 on PC, and those browsers do not exhibit this behaviour.
If you haven't used, HTTP Response 204 can be very convenient. 204 tells the server to immediately termiante this request. This is helpful if you want a javascript (or similar) client-side function to execute a server-side function without refreshing or changing the current webpage. Great for updating database, setting global variables, etc.
header("status: 204"); (or the other call)
header("HTTP/1.0 204 No Response");
If you use session_start() at the top of a php script that also has header() calls later in the script for a file download then you must add some form of cache control for IE to work properly. I use header('Cache-Control: public'); immediately after the code at the top of the script with the session_start() call that verifies that I have a properly logged in user. That allows the header() and fpassthru() calls to download a file later in the script using IE 5.5 SP2.
Diese Seite bei php.net