Hack 68 Force PDF Download Rather than Online Reading

Prevent your online PDF from appearing inside the browser.

Some PDF documents on the Web are intended for online reading, but most are intended for download and then offline reading or printing. You can prevent confusion by ensuring your readers get the Save As . . . dialog when they click your Download Now PDF link. Here are a few ways to do this.

Keep in mind that any online PDF can be downloaded. If your online PDF is hyperlinked to integrate with your web site, you should take precautions against these links being broken upon download. One option is to use only absolute URLs throughout your PDF. Another option is to set the Base URL of your PDF. In Acrobat 6, consult File Document Properties Advanced Base URL. In Acrobat 5, consult File Document Properties Base URL. To prevent people from easily downloading your document, see [Hack #71] .

5.19.1 Zip It Up

The quickest solution for a single PDF is to compress it into a zip file, which gives you a file that simply cannot be read online. This has the added benefit of reducing the download file size a little. The downside is that your readers must have a program to unzip the file. You should include a hyperlink to where they can download such a program (e.g., http://www.info-zip.org/pub/infozip/). Stay away from self-extracting executables, because they work on only a single platform.

You can also apply zip compression on the fly with your web server. Here is an example in PHP. Adjust the passthru argument so that it points to your local copy of zip:

<?php

// pdfzip.php, zip PDF at serve-time

// version 1.0

// http://www.pdfhacks.com/serving_pdf/

//

// WARNING:

// This script might compromise your server's security.



$fn= $_GET['fn'];

// as a security measure, only serve files located in our directory

if( $fn && $fn=== basename($fn) ) {



  // make sure we're zipping up a PDF (and not some system file)

  if( strtolower( strrchr( $fn, '.' ) )== '.pdf' ) {



    if( file_exists( $fn ) ) {

      header('Content-Type: application/zip');

      header('Content-Disposition: attachment; filename='.$fn.'.zip');

      header('Accept-Ranges: none'); // we don't support byte serving

      passthru("/usr/bin/zip - $fn");

    }

  }

}

?>

If you have a PDF located at http://www.pdfhacks.com/docs/mydoc.pdf and you copied the preceding script to http://www.pdfhacks.com/docs/pdfzip.php, you could serve mydoc.pdf.zip with the URL http://www.pdfhacks.com/docs/pdfzip.php?fn=mydoc.pdf.

5.19.2 Create Download-Only Folders Using .htaccess Files

Do you have an entire directory of download-only PDFs on your web server? You can change that directory's .htaccess file so that visitors are always prompted to download their PDFs. The trick is to send suitable Content-Type and Content-Disposition HTTP headers to the clients.

This works on Apache and Zeus web servers that have their .htaccess features enabled. In your PDF directory, add a file named .htaccess that has these lines:

<files *.pdf>

  ForceType application/octet-stream

  Header set Content-Disposition attachment

</files>

5.19.3 Serve PDF Downloads with a PHP Script

This next script enables you to serve PDF downloads. It is handy for when you want to make a single PDF available for both online reading and downloading. You can use its technique of using the Content-Type and Content-Disposition headers in any script that serves download-only PDF.

<?php

// pdfdownload.php

// version 1.0

// http://www.pdfhacks.com/serving_pdf/

//

// WARNING:

// This script might compromise your server's security.



$fn= $_GET['fn'];

// as a security measure, only serve files located in our directory

if( $fn && $fn=== basename($fn) ) {



  // make sure we're serving a PDF (and not some system file)

  if( strtolower( strrchr( $fn, '.' ) )== '.pdf' ) {



    if( ($num_bytes= @filesize( $fn )) ) {

      // use file pointers instead of readfile( )

      // for better performance, esp. with large PDFs

      if( ($fp= @fopen( $fn, 'rb' )) ) { // open binary read success



        // try to conceal our content type

        header('Content-Type: application/octet-stream');



        // cue the client that this shouldn't be displayed inline

        header('Content-Disposition: attachment; filename='.$fn);



        // we don't support byte serving

        header('Accept-Ranges: none');



        header('Content-Length: '.$num_bytes);

        fpassthru( $fp ); // this closes $fp

      }

    }

  }

}

?>

If you have a PDF located at http://www.pdfhacks.com/docs/mydoc.pdf and you copied the preceding script to http://www.pdfhacks.com/docs/pdfdownload.php, the URL http://www.pdfhacks.com/docs/pdfdownload.php?fn=mydoc.pdf would prompt users to download mydoc.pdf to their computers.