mysql php file download problem - file is corrupt and named to directory path

I have a database set up that stores a $filepath and other file info and a download script to retrieve the file and download it. Whenever I try to download a file it changes the name of the file im trying to download to the name of the the full path on the server (ex file is on server as "b3e9e4e56d146bdb45ef727f30986f95.doc" but saves as "C--Apache2-htdocs-website-submitted-b3e9e4e56d146bdb45ef727f30986f95" when i download it.) And the files are corrupt and filled with jibberish if they can be opened. Any help would be appreciated this is driving me insane and im on a deadline to finish this up tongiht!! Thanks!!!

fdownload.php

------------------------------------------------------------------------------------------------------

<?php

if ($_GET['submitnum'])

{

  include ("dbconnect.php");

    $submitnum = $_GET['submitnum'];

    $query = "select filepath, filetype, filename, filesize from submitted where submitnum=$submitnum";

    $result = @mysql_query($query, $conn);

    list($filename, $filetype, $filesize, $filepath) = mysql_fetch_array($result);

  header("Content-Disposition: attachment; filename=$filename");

  header("Content-length: $filesize");

  header("Content-type: $filetype");

  readfile($filepath);

  exit;

}

?>

------------------------------------------------------------------------------------------

fupload.php

------------------------------------------------------------------------------------------

  if($_POST['file'] != "none" && $_FILES['file']['size'] > 0)

  {

      $uploaddir = "C:/Apache2/htdocs/finalproject/posted/";

      $classnum=$_POST['class'];

      $description=$_POST['description'];

      $duedate=$_POST['duedate'];

      $file=$_POST['file'];

      $filename = $_FILES['file']['name'];

      $tmpname = $_FILES['file']['tmp_name'];

      $filesize = $_FILES['file']['size'];

      $filetype = $_FILES['file']['type'];

      $ext = substr(strrchr($filename, "."), 1);

      $randname = md5(rand() * time());

      $filepath = $uploaddir . $randname . '.' . $ext;

      $result = move_uploaded_file($tmpname, $filepath);

      $query = "insert into posted (userid, duedate, classnum, description, filename, filesize, filetype, filepath ) values ('$id', '$duedate', '$classnum','$description', '$filename', '$filesize', '$filetype', '$filepath')";

      $result=mysql_query($query) or die("query error");

      if ($result==0)

      {

          echo "An error has occurred. Assignment was not posted.";

      }

      else

      {

        echo "You have successfully posted an assignment.";

      }

  }

  else

  {

      echo "You must select a file for upload!";

  }

}

--------------------------------------------------------------------------------

anyone have some insight? have looked everywhere for some info but i cant seem to find out what is wrong here. any help would be greatly apppreciated!! Thanks!

readfile($filepath);

should be...

readfile($filepath.'/'.$filename);

but I am not so sue this will do what you want....

I am just looking around for a pretty good php download script I have. Ill give it you tomorrow if you remember to get in touch.

ah thanks for the help but im trying to finish this up before i leave town tomorrow for a job interview!