Download script returns corrupted download files
<p>I have created a download script in order to hide the file location and to force people passing by our website to download a file. it should return a .jar file.
When i post a .jar file to download it'll return corrupt!
so we changed the file-extension to .zip to test if that would work. Now i can download it for myself but other people still report corruption of the file...</p>

<p>here's a link to the live download page: <a href="https://www.run2stay.com/?p=download" rel="nofollow">https://www.run2stay.com/?p=download</a></p>

<p>here's the code used inside download.php:</p>

<pre><code>&lt;? session_start(); 
include_once("inc/conf.php");

if ($stmt = $slc-&gt;prepare("SELECT   id,
                                creator,
                                name,
                                version,
                                discription,
                                changelog,
                                readme,
                                file,
                                datum,
                                downloads
                        FROM download ORDER by id desc")) {
$stmt-&gt;execute();
$stmt-&gt;store_result();

if ($stmt-&gt;num_rows == 0) {
    echo "&lt;h3&gt;Oops!&lt;/h3&gt;&lt;p&gt;Seems like there are no downloads yet!&lt;/p&gt;";
} else {

    $stmt-&gt;bind_result($down_id, $creat, $name, $vers, $disc, $change, $read, $file, $dat, $down);
    while ($stmt-&gt;fetch()) { ?&gt;

&lt;h3 id="&lt;?=$down_id;?&gt;"&gt;&lt;?=$name;?&gt; &lt;?=$vers;?&gt; &lt;i&gt;by &lt;?=$creat;?&gt;&lt;/i&gt;&lt;/h3&gt;
&lt;?=$dat;?&gt;
&lt;? if (!empty($disc)) { ?&gt;
&lt;h4&gt;Discription:&lt;/h4&gt;
&lt;p id="ber"&gt;&lt;?=$disc;?&gt;&lt;/p&gt;
&lt;? } if (!empty($change)) { ?&gt;
&lt;h4&gt;Changelog:&lt;/h4&gt;
&lt;p id="ber"&gt;&lt;?=$change;?&gt;&lt;/p&gt;
&lt;? } if (!empty($read)) { ?&gt;
&lt;h4&gt;Readme:&lt;/h4&gt;
&lt;p id="ber"&gt;&lt;?=$read;?&gt;&lt;/p&gt;
&lt;? } ?&gt;
&lt;h4&gt;Download:&lt;/h4&gt;
&lt;? $_SESSION["dl"] = $_SERVER["HTTP_HOST"]; ?&gt;
&lt;input type="button" value="download" onclick="location.href='?p=dl&amp;get=&lt;?=$file;?&gt;&amp;w=&lt;?=$down_id;?&gt;';"&gt;&amp;nbsp;&lt;?=$down;?&gt; times downloaded.
&lt;hr&gt;

&lt;? } } } ?&gt;
</code></pre>

<p>The code i used inside dl.php</p>

<pre><code>&lt;?php
include_once("inc/conf.php");

if (!empty($_GET)) {

$file = htmlspecialchars($_GET['get']);
$file = "mods/$file";
$down_id = htmlspecialchars($_GET['w']);

session_start();

if(isset($_SESSION["dl"])) {
$referrer = $_SERVER["HTTP_REFERER"];
$referrer = parse_url($referrer);
if($referrer["host"] != $_SESSION["dl"]) {
echo "&lt;meta http-equiv=refresh content=0;URL=?p=download&gt;";
die();
  }
} else {
echo "&lt;meta http-equiv=refresh content=0;URL=?p=download&gt;";
die();
}

unset($_SESSION["dl"]);

if (file_exists($file)) {
header('Content-Description: File Transfer'); 
header("Expires: fri, 1 Jan 2016 00:00:00 GMT"); // Don't change.
header('Content-Type: application/java-archive');
header('Content-Disposition: attachment; filename="'.basename($file).'"');
header('Cache-Control: must-revalidate');
header('Pragma: public');
header('Content-Length: ' . filesize($file));
readfile("$file");

$qry = "UPDATE download SET downloads=downloads+1 WHERE id=?";
$stmt = $slc-&gt;prepare($qry);
$stmt-&gt;bind_param('s',$down_id);
$stmt-&gt;execute();
$stmt-&gt;close();

exit;
} else {
echo "&lt;h3&gt;Oops!&lt;/h3&gt;&lt;p&gt;Looks like something horrible went wrong!&lt;/p&gt;";
}
}
?&gt;
</code></pre>