Copy this code and paste it in your HTML
<?php
if($_GET){
if($_GET['file']) {
$filename = $_GET['file'];
$download_path = "files/";
}
if(eregi("\.\.", $filename)) die("I'm sorry, you may not download that file.");
if(eregi("\.ht.+", $filename)) die("I'm sorry, you may not download that file.");
$file = "$download_path$file";
if(!file_exists($file)) die("I'm sorry, the file doesn't seem to exist.");
$today = date("F j, Y, g:i a");
header("Content-type: $type");
header("Content-Disposition: attachment;filename=$filename");
header("Content-Transfer-Encoding: binary");
}
?>