File security

[eluser]frist44[/eluser]
Great idea. I actually started toying around with the same idea not long after I posted. I'm having trouble though because I made a test function that works file:

Code:

$path = $this->config->item('base_path') . 'data/sample.xls';
        
        header('Content-type: application/excel');
        header('Content-Disposition: attachment; filename="data.xls"');

        
        echo file_get_contents($path);

This worked fine and delivered the content to the browser in the same format. I try it with my real controller and everything it opens, it says it's a different format than the file was saved.

Code:

if ($purchase = $this->purchases_model->is_user_authorized_for_download(userid(), $purchaseid)) {

            $fullpath = $this->config->item('base_path') . $purchase['datapath'];
            
            //file_get_contents($fullpath);
            
            header("Content-Type: application/msexcel; ");
            header("Content-Disposition: attachment; filename=\"" . $purchase['title'] . ".xls\"; ");

            readfile($fullpath);

            
        } else {
            
            redirect_with_error(base_url(), 'flash_error_download');
        }

any idea why the latter doesn't work?