View file download.php

<?php
error_reporting(0);
include 'inc/db.php';
function df($fn, $name, $type)
{
if (!file_exists($fn))
die('Файл не существует.');
@ob_end_clean();
$ff=0;
$size=filesize($fn);
header('HTTP/1.1 200 OK');
$ETag=md5($fn);
$ETag=substr($ETag, 0, 8) . '-' . substr($ETag, 8, 7) . '-' . substr($ETag, 15, 8);
header('ETag: "'.$etag.'"');
header('Accept-Ranges: bytes');
header('Content-Length: '.$size);
header('Content-Type: '.$type.'; charset=utf-8');
header('Connection: close');
$f=fopen($fn, 'a+');
if (preg_match('#^image/#i',$type))
header('Content-Disposition: filename="'.$name.'";');
else
header('Content-Disposition: attachment; filename="'.$name.'";');
echo fread($f, $size);
fclose($f);
}
$id=intval($_GET['id']);
$file=mysql_fetch_assoc(mysql_query("SELECT `name`, `ras`, `ds` FROM `obmen` WHERE `id` = '$id'"));
$hhost=str_ireplace('.', '_', $_SERVER['HTTP_HOST']);
$name=str_ireplace('.', '_', str_ireplace(',', '_', htmlspecialchars($file['name']))).'_('.$hhost.')';
$ras=htmlspecialchars($file['ras']);
if (!$_GET['id']){
header('Location: /obmen.php');
die();
}
df('obmen/'.$id.'.file', $name.'.'.$ras, $file['type']);
$q=($file['ds']+1);
mysql_query("UPDATE `obmen` SET `ds` = '$q' WHERE `id` = '$id'");
mysql_query("INSERT INTO `log` (`user`, `text`, `time`) values ('$user[id]', 'Скачивание файла №$id', '".time()."')");
?>