Deny from all
print("<td align=left><a href='./download.php?name=$file'>$file</a></td>");
<?
$file = ("./files/".$_GET['name']);
header ("Content-Type: application/octet-stream");
header ("Accept-Ranges: bytes");
header ("Content-Length: ".filesize($file));
header ("Content-Disposition: attachment; filename=".$_GET['name']);
readfile($file);
?>