if (preg_match('/((\w+)(MidRes|LowRes))\.php/U', $id, $matches)) { $santised_filename = mysql_real_escape_string($matches[2]); $sql = "SELECT mime_types.extension, mime_types.mime_type FROM mime_types, quicktime_demos WHERE quicktime_demos.shortname = '$santised_filename' AND mime_types.id = quicktime_demos.mime_type"; $result = mysql_query($sql) or die("Query failed (demos): " . mysql_error()); $row = mysql_fetch_array($result); if ($row) { $filename = $matches[1].'.'.$row['extension']; header('HTTP/1.1 200 OK'); header("Content-Type: {$row['mime_type']}"); header("Content-Length: ".filesize($filename)); header("Content-Disposition: attachment; filename=$filename"); readfile($filename); exit(); } }