如题
$file=str_replace(array('../',':','\'','"'),array('','','',''),$_GET['photo']); 
$filename=end(explode("/",$_GET['photo'])); 
$type=end(explode(".",$file));
header('Content-type: image/'.$type); 
header('Content-Disposition: attachment; filename='.basename($filename));
readfile($file);