这个PHP代码有什么问题，有SQL查询吗？

Question

Many days ago, I have read this question. Then, I have tried with this code:

$code = $_GET['code'];
$str_1 = mysql_query("SELECT * FROM `MyTable`");
while ($str_2 = mysql_fetch_array($str_1)) {
    header("content-type: application/octet-stream");
    header("content-disposition: inline; filename= " . $str_2['my_id'] . "");
    echo base64_decode($str_2['my_str']);
}

My my data base, there are some data:

+--------+-----------------+
|  my_id |     my_str      |
+--------+-----------------+
|  id_1  |  base64_str_1   |
|  id_2  |  base64_str_2   |
|  id_3  |  base64_str_3   |
|  id_4  |  base64_str_4   |
+--------+-----------------+

When I browse my PHP code with browser, such as: http://localhost/my_php.php?code=id_3. It always returns a file (named: id_3) which is contented (it's content: base64_str_1).

Can you tell me: "What is wrong in this PHP code, with SQL query?".

Answer 1

With this code, You'll get the name of last row id from query. Just due to you replaced the header in:

header("content-disposition: inline; filename= " . $str_2['my_id'] . "");

The content, is being generated with a concatenation from all str rows. So, the generated content is:
base64_str_1base64_str_2base64_str_3base64_str_4 and not only base64_str_1

If you need to generate a unique file from one row from MyTable, you could to use:

$code = $_GET['code'];
$str_1 = mysql_query("SELECT * FROM `MyTable` where my_id = '$code'");
header("content-type: application/octet-stream");
header("content-disposition: inline; filename= " . mysql_result($str_1, 0, 'my_id') );
echo base64_decode(mysql_result($str_1, 0, 'my_str'));