title: How to prevent users from downloading source code files using the PHP download option I have for downloading pdf files in my web application?
body: <p><strong>Download.php</strong></p>
  
  <pre><code>&lt;?php 
  $file = $_GET['file'];
  if(file_exists($file)) {
  header('Content-Description: File Transfer');
  header('Content-Type: application/octet-stream');
  header('Content-Disposition: attachment; filename='.basename($file));
  header('Content-Transfer-Encoding: binary');
  header('Expires: 0');
  header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
  header('Pragma: public');
  header('Content-Length: ' . filesize($file));
  ob_clean();
  flush();
  readfile($file);
  exit;
  }
  ?&gt;
  </code></pre>
  
  <p>Following is the JavaScript code I'm using to pass the url to php script:
  <strong>Download.js</strong></p>
  
  <pre><code>init:function(){
      this.control({
          '#downloadSite': {
              load:function(tree, node, records, successful, eOpts)
              {
  
              },
  
              itemclick:  function(tree, record, item, index)
              {
                  if(record.get('id') == 300){
                      window.open('Download.php?file=../TAB/'+record.get('url'));
                  }
                  else{
                      window.open('Download.php?file=../PDF/'+record.get('url'));
                  }                   
              },
              beforeitemclick:  function(tree, record, item, index)
              {
                  if(record.get('leaf') == false) return false;
              },
              beforeitemdblclick: function(){
                  return false;
              }
          }
      });
  }
  </code></pre>
  
  <p>If I am entering "Download.php?file=../web.config" in the url , web.config file is being downloaded. I want to prevent direct download of source code. the download option is for downloading pdf files that I have stored in the pdf's folder in the main directory. </p>
  
  <p>Please help !!</p>