About a decade ago I built a force download script, to get the browser to download the script instead of trying to open it in a new window (eg pdf), all you had to do was pass in the location of the file and it would download it regardless. i didnt put any restrictions in place, so you could download all the server files etc!!! Needless to say i fixed it ASAP