php - Something weird about the download script -

good day,

just having trouble [again] download script. right now, issue whenever tried download file, download.php has been fetching , not ms excel file itself. though in process of downloading, shows icon , application file trying download in excel format. not understand downloaded it, become empty download.php

here codes calling download:

<?php       $up = mysql_query("select * upload");              $countrow=0;             while($cr = mysql_fetch_array($up))                 {                        echo "<div style='float:left; '>";                   echo "<p style='padding:5px; margin:5px; border:1px solid #ccc; '>";                  echo "<a href='rental/download.php?id=".$cr['upload_id']."'><img src='images/icon.png'> </a>"." "."<a href='download.php?id=".$cr['upload_id']."'>".$cr['file_name']."  "."</a>";                 echo "</p>";                 echo "</div>";                           }              $countrow++;  ?> 

and download.php

<?php  if(isset($_get['id']))  {   $id    = $_get['id'];  $query = "select file_name, file_type, file_size, content   upload upload_id = '$id'";  $result = mysql_query($query) or die('error, query failed');  list($name, $type, $size, $content) = mysql_fetch_array($result);  header("content-length: $size");  header("content-type: $type");  header("content-disposition: attachment; filename=$name");  ob_clean();  flush();  echo $content;  mysql_close();  exit;  }   ?> 

what gonna do? wonder went wrong...

use header('content-disposition: attachment; filename=' . $name);

additionally, try use single quotes , concatenate strings, rather double quotes. double quotes eval(), , not recommended if don't need it.

also, use pdo database access or @ least mysqli, , sanitize input before including sql query. or 'download.php?id=1'; drop table user;-- you. http://xkcd.com/327/