[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now


PHP Headers for Exporting Excel in SSL

Posted on 2009-04-30
Medium Priority
Last Modified: 2013-12-12
I am having a very difficult time getting an export of an Excel file to work in a HTTPS/SSL environment.  When I run the script in regular HTTP non-SSL environment it works fine.
What are the proper HEADERS I need to use when downloading an Excel file in a SSL website?

I've tried all kinds of headers based on similar issues I found on web searches, but nothing works.

I am using IE 7 with PHP5.2 Apache
  $sessvar = $_GET['sessvar'];
  $htmltab = $_SESSION[$sessvar];
  $filename = "export.xls";
  header('Content-Type: application/vnd.ms-excel');
  header('Pragma: private');
  header('Cache-control: private, must-revalidate');
  header("Content-Disposition: attachment; filename=$filename");
  header("Expires: 0");
  header("Keep-Alive: timeout=15, max=100");
  header("Connection: Keep-Alive");
  header("Transfer-Encoding: chunked");
  print $htmltab;

Open in new window

Question by:mamuscia
  • 6
  • 5
LVL 51

Expert Comment

by:Steve Bink
ID: 24277228
AFAIK, there should be no difference in the HTTP headers.  SSL should be transparent at that level.  Use the same headers you are using for your normal download.  

When you say "nothing works", what actually happens?

Author Comment

ID: 24279024
I know for sure it is SSL getting in the way as it works under HTTP, but not HTTPS.

Here is the process of events and the results:

1 - display a form to user from PHP program
2 - user fills in date ranges on form and submits
3 - the same PHP script is invoked and the $_POST variables picked up
4 - the PHP script then does a MySQL query using the parameters the user provided in the form
5 - the script then creates an HTML table from the results of the MySQL query
6 - the HTML table contents is put into a session variable so the export script can pick it up
6 - there is an ONLOAD event triggered that starts a javascript to open a new window
7 - the new window opens, picks up the HTML table contents from the session variable, then
tries to force the download as an EXCEL file using the script example I provided above.

What happens at this point is IE has opened the new window, but it just flashes and ends without downloading the EXCEL file.  Again, when done in HTTP, it opens the download dialog box asking me to OPEN/SAVE/CANCEL.  I  am able to get the EXCEL file in HTTP.  But in HTTPS, the new window opens, then closes without putting up the download dialog box.

I have read many forums and other sites that had similar issues with HTTPS.  They suggest many different HEADER solutions, I've tried them all, but none have worked.

By the way, I can STOP the browser when the new window opens and then refresh that window.
The first time I refresh it, it gives me a windows IE error message saying the web site cannot be found.  But if I stop it and refresh it again, the download dialog works.    See the attached file of the picture of the IE error window I get when I stop it the first time.

I think this is an IE issue with HTTPS as it works fine in FIREFOX.

I came to EXPERTS-EXCHANGE because I usually get solutions that work.

Hope you, or someone else knows how to fix this...thanks
LVL 51

Expert Comment

by:Steve Bink
ID: 24284386
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!


Author Comment

ID: 24294165
I did see this and I stripped the code so that no cache references were made at all.  

header('Content-Type: application/vnd.ms-excel');
header("Content-Disposition: attachment; filename=$filename");

I installed IE 8 and it still happens and the article you point to above does not have a fix for IE 8, it only goes up to IE 6.

There has got to be a solution to this as I'm sure other sites have run into similar issues.
LVL 51

Expert Comment

by:Steve Bink
ID: 24301374
What about saving the table to a temp file, then forwarding the user to it?

Author Comment

ID: 24303933
I tried putting the generated table into a file on the server, then downloading it for the user.  I get the same error where IE says it cannot load or find the website....

Do you know anything about the PEAR install for Spreadsheet_Excel_Writer?  Will it work in an HTTPS environment?  I am going to try to install that and use it for manipulating Excel files.  
LVL 51

Expert Comment

by:Steve Bink
ID: 24311073
I've used that package, and it works pretty well.  A few formatting issues, but a good API for creating quick and dirty spreadsheets.

The problem here is likely not in your code.  SSL works at a different level.  The server processes the PHP file, runs the script, and generates an output.  That output is what is transmitted to the client.  Using SSL encrypts that transmission instead of allowing it go on the wire as plain-text.

I'll see if I can find some time over the next couple days to experiment with some file download code and SSL.  I created a downloadable EDI export file for another SSL-only website I managed...I'll look over that code for anything particular to make it work, but I have never encountered the issue you are reporting.

Author Comment

ID: 24315577
Thanks for helping research/test this.  I installed the spreadsheet excel writer and it generates the Excel file nicely.  It works in Firefox as always, but in IE it still does not work.  I will continue to experiment and search as well.  Maybe we can come up with a solution here.
LVL 51

Expert Comment

by:Steve Bink
ID: 24323455
>>> It works in Firefox as always, but in IE it still does not work.

Specifically, what doesn't work in IE but works in FF?

Author Comment

ID: 24325157
In firefox, it opens a prompt box to OPEN/SAVE/CANCEL the generated EXCEL file.  In IE, it gives me the message that says it cannot open the website.  See my very first entry above.  I've continued researching and it must have something to do with cache/no-cache and https, but for the life of me, I cannot come up with the right combination of HEADER statements in my PHP script.  I also have seen articles explaining SESSION caching options, but again, when I try those solutions none work.

Accepted Solution

mamuscia earned 0 total points
ID: 24327675
I found the solution and have tested it successfully.  I found this on an open issues site for IBM Websphere.  It describes the process IE goes through when you export an Excel file.   Based on this I ended up putting the following header statements in my PHP script and it works now.  


When you attempt to export or download a Microsoft Excel file, in an SSL environment, the following error occurs:

"Internet Explorer cannot download xxx.xls from xxx.com. Internet Explorer was not able to open this Internet site. The requested site is either unavailable or cannot be found. Please try again later."

This behavior does not occur in Firefox.  
This behavior is related to the way in which Internet Explorer launches content that originates from secured sites (i.e,, sites accessed using SSL).

When Internet Explorer receives content, such as an Excel spreadsheet, it dumps the content into a cache. Then, it launches the associated application using the content from the cache. When using SSL, Internet Explorer enforces "no cache" HTTP response headers so the content never gets saved into the cache and the application launch fails.
Headers now being used with both firefox and IE are:

header("Pragma: public");
header("Content-Type: application/x-msexcel; name=\"$fname\"");
header("Content-Disposition: inline; filename=\"$fname\"");

The key statement for IE is the Pragma: public, which forces IE to cache the excel export, therefore the helper program (Excel in this case) can find the output in the cache.

Featured Post

 The Evil-ution of Network Security Threats

What are the hacks that forever changed the security industry? To answer that question, we created an exciting new eBook that takes you on a trip through hacking history. It explores the top hacks from the 80s to 2010s, why they mattered, and how the security industry responded.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Microservice architecture adoption brings many advantages, but can add intricacy. Selecting the right orchestration tool is most important for business specific needs.
The title says it all. Writing any type of PHP Application or API code that provides high throughput, while under a heavy load, seems to be an arcane art form (Black Magic). This article aims to provide some general guidelines for producing this typ…
Explain concepts important to validation of email addresses with regular expressions. Applies to most languages/tools that uses regular expressions. Consider email address RFCs: Look at HTML5 form input element (with type=email) regex pattern: T…
The viewer will learn how to create and use a small PHP class to apply a watermark to an image. This video shows the viewer the setup for the PHP watermark as well as important coding language. Continue to Part 2 to learn the core code used in creat…
Suggested Courses
Course of the Month19 days, 7 hours left to enroll

872 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question