<?php
if(!empty($_GET['file']) && file_exists($_GET['file'])){
    $filename = trim($_GET['file']);

    @header('Content-Disposition: attachment; filename="'.basename($filename).'"');
    @header('Content-Type: application/x-force-download; name="'.basename($filename).'"');

     $filename = str_replace('..', '', $filename);
     readfile(dirname(__FILE__) . '/' . $filename);
}
?>