List approved files from a directory with PHP

A directory-backed download list is useful for a small collection of public PDFs or images. The important word is public: hiding a filename from the list does not stop someone requesting the file directly.

Give the list its own directory

Put only publication-approved files in downloads/, alongside this PHP page, and serve that directory at /downloads/. The code is deliberately non-recursive: it lists files from that one directory, not the surrounding project.

<?php
declare(strict_types=1);

$directory = __DIR__ . '/downloads';
$extensions = ['pdf', 'jpg', 'jpeg', 'png', 'mp3', 'docx'];
$names = [];

if (!is_dir($directory) || is_link($directory)) {
    throw new RuntimeException('The public download directory is unavailable.');
}

foreach (new FilesystemIterator($directory, FilesystemIterator::SKIP_DOTS) as $entry) {
    $name = $entry->getFilename();
    if ($entry->isLink() || !$entry->isFile() || str_starts_with($name, '.')
        || !in_array(strtolower($entry->getExtension()), $extensions, true)) {
        continue;
    }
    $names[] = $name;
    if (count($names) > 100) {
        throw new RuntimeException('Use a paginated catalogue for a larger library.');
    }
}
natcasesort($names);

echo '<ul>';
foreach ($names as $name) {
    $label = htmlspecialchars($name, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
    echo '<li><a href="/downloads/' . rawurlencode($name) . '">'
        . $label . '</a></li>';
}
echo '</ul>';

Filename encoding keeps spaces and characters such as & from breaking the URL. HTML escaping protects the visible label independently. Neither is a substitute for deciding which files belong online.

Do not turn this into a file browser

Keep the filesystem path in code or trusted configuration, never in a query parameter. Backups, invoices, source files and customer documents belong elsewhere. For private downloads, use an authenticated handler with a per-file permission check rather than direct public links. Uploaded files also need their own content validation and safe serving policy; an extension allowlist alone does not establish a file's actual type.

References: FilesystemIterator and escaping HTML.