Counting the number of downloads

[graham23s]

Hi Guys,

on my site when a user goes to the "downloads.php" page i update mysql to say downloads+1 to increment the number of downloads each time (but saying that not everyone who goes to the downloads page downloads something)

the code is pretty basic:

downloads.php

     // start by grabbing the id...//////////////////////////////////////////////////
     $id = $_GET['id'];    
     
     // get the file...///////////////////////////////////////////////////////////////////
     $query1 = "SELECT * FROM `uploads` WHERE `id`='$id'"; 
     $result1 = mysql_query($query1);
     $row = mysql_fetch_array($result1);
     
     $file_id = $row['file_id']; 
     $file_name = $row['file_name'];
     
     // update the hit counter...////////////////////////////////////////////////////////
     mysql_query("UPDATE `uploads` SET `downloads`=`downloads` + 1 WHERE `id`='$id'"); 

i was thinking a better way would be to place a button there when pressed the download box pops up and THEN it increments mysql but i'm not entirely sure where to go from there i can do the buttons ok:

<input type="submit" name="submit" value="download" /> 

so when the button is pressed the downloads starts (it's not a specific filename) so the name of the downloaded file changes depending on what the uploader has called it kinda thing.

any help would be great.

cheers

Graham

[SecondV]

So,

// start by grabbing the id...//////////////////////////////////////////////////
 
     $id = $_GET['id'];    
 
 
 
     // get the file...///////////////////////////////////////////////////////////////////
 
     $query1 = "SELECT * FROM `uploads` WHERE `id`='$id'"; 
 
     $result1 = mysql_query($query1);
 
     $row = mysql_fetch_array($result1);
 
 
 
     $file_id = $row['file_id']; 
 
     $file_name = $row['file_name'];
 
 
 
     // update the hit counter...////////////////////////////////////////////////////////
 
     mysql_query("UPDATE `uploads` SET `downloads`=`downloads` + 1 WHERE `id`='$id'");

is all that's in downloads.php? - You could do the following:

// start by grabbing the id...//////////////////////////////////////////////////
 
$id = intval($_GET['id']); // going straight to mysql without making sure it's an int.. not wise
 
if ($id == 0)
{
    exit;
}
 
// get the file...///////////////////////////////////////////////////////////////////
$query1 = mysql_query("
    SELECT file_id, file_name
    FROM uploads WHERE id=$id
"); 
 
if (mysql_num_rows($query1) > 0)
{
    echo 'Your download should start immediately.';
 
    $row = mysql_fetch_assoc($query1);
    $file_id = $row['file_id']; 
    $file_name = $row['file_name'];
 
    // update the hit counter...////////////////////////////////////////////////////////
    mysql_query("
        UPDATE uploads
        SET downloads=downloads+1
        WHERE id=$file_id
    ");
}
exit;

Then for the button, something like this *may* work:

<input type="submit" name="submit" value="download" onclick="window.open('downloads.php?id=(code here to set id)');" />

If I understand what you're wanting to do.. correctly.

[graham23s]

Hi Mate,

that's pretty much it it's given me something to work on thanks mate

Graham

[SecondV]

No problem

[earl-grey]

Your script is vulnerable by SQL injection