Creating a file on the fly in php (extension problem)

Question

I create a file on the fly in PHP containing plain text and then tell the browser to download it using the following code:

# Create the verification file and force-download it. header("Content-type: text/plain"); header("Content-Disposition: attachment; filename='.ecf'"); #1 header("Pragma: no-cache"); header("Expires: 0"); echo "..."; 

As shown on line with #1 , I want the download file to be named .ecf , but with my current code, when it loads with the name ecf (without extension).

How can I tell PHP to save the file as .ecf instead of ecf ?

---

Note. The problem that I am facing is that the downloaded file does not have an extension, and is not trying to create and upload the file on the fly, so please refrain from marking this question as duplicating many existing questions regarding this.

---

Edit: As also pointed out in the comments, I tried to escape the dot, but then the downloaded file has the name -.ecf .

Answer 1

This is a browser-level security limitation. Files starting with . - "dotfiles" have a special function on OSX and Linux (and are hidden by default), so you can drop them in the "User files" folder, which could potentially lead to malicious actions.

https://www.w3.org/TR/html5/links.html#downloading-resources

Otherwise, if the named type is known to be potentially dangerous (for example, it will be processed by platform conventions as an embedded executable, a shell script, an HTML application or a document with the ability to execute macros), and then it is not necessary to change the file name to add the known secure extension (for example, ".txt").

Answer 2

You can create a file with php. Here is the attempt I made with the .php extension and it worked:

 <? $file = "test.php"; $content ="testing\n That is\n working"; if(!is_file($file)){ file_put_contents($file, $content); } ?> 

The! before is_file means that it checks to see if the file with the name has completed, then create it and fill it with the contents from $ content.

Perhaps this is something for you. Just point the header to $ file?