Using HTTP Range Requests for Partial Downloads

Using HTTP Range Requests for Partial Downloads shows how to apply a focused PHP technique using understandable, runnable examples and clearly defined constraints.

What Problem Does This Solve?

Treat headers, body fields, methods and URLs as untrusted inputs. Validate access rights, input types and destination hosts before any network or database side effect.

Core Concepts

• Identify the data entering the operation and the expected output.
• Treat headers, body fields, methods and URLs as untrusted inputs. Validate access rights, input types and destination hosts before any network or database side effect.
• Handle expected failures and test boundary conditions rather than assuming success.

Example 1: A Small Working Example

Start with a small input so the behavior is easy to follow.

<?php

$rangeHeader = "bytes=100-199";
if (preg_match("~^bytes=([0-9]+)-([0-9]+)$~D", $rangeHeader, $matches)) { $startByte = (int)$matches[1]; $endByte = (int)$matches[2]; echo $endByte - $startByte + 1; }

The pattern limits acceptable path values and extracts named parameters. Cast numeric captures and apply authorization separately from route matching.

Example 2: A Different Case

The second example changes the task or data while using the same general technique.

<?php

$fileSize = 1000;
$rangeStart = 100;
$rangeEnd = min(199, $fileSize - 1);
if ($rangeStart > $rangeEnd) { throw new InvalidArgumentException("Invalid range"); }
echo "Content-Range: bytes $rangeStart-$rangeEnd/$fileSize";

The example isolates the important operation and its expected input. Adapt the values, error handling and boundaries for your application rather than assuming all input is trusted.

Practical Example

This practical example is a complete standalone PHP snippet to adapt to a real application.

<?php

$filePath = __FILE__;
$fileLength = filesize($filePath);
$rangeStart = 0;
$rangeEnd = min(127, $fileLength - 1);
$streamHandle = fopen($filePath, "rb");
fseek($streamHandle, $rangeStart);
$partialData = fread($streamHandle, $rangeEnd - $rangeStart + 1);
fclose($streamHandle);
echo strlen($partialData);

The example isolates the important operation and its expected input. Adapt the values, error handling and boundaries for your application rather than assuming all input is trusted.

Important Behavior and Edge Cases

• Only allow authorized destinations and operations. Set timeouts, handle non-success status codes and avoid exposing stack traces or credentials in responses.
• Treat headers, body fields, methods and URLs as untrusted inputs. Validate access rights, input types and destination hosts before any network or database side effect.
• Test a malformed input, a missing dependency and a boundary value when those cases apply.

Comparison With Related Approaches

Common Beginner Mistakes

Key Takeaways

• Treat headers, body fields, methods and URLs as untrusted inputs. Validate access rights, input types and destination hosts before any network or database side effect.
• Use a router or PSR-7 abstraction for larger apps; small apps can route explicit paths with a checked method.
• Write tests around the inputs and failure cases most likely in your application.

Use these examples as a starting point and adapt the validations and boundaries to the specific application.