ok grazie lo stesso ho risolto così:
codice:
<?
function forceDownload(&$file){
     
	if( file_exists($file) == true && is_readable($file) == true) {
		$filename = &basename($file);
		if( strpos($_SERVER['HTTP_USER_AGENT'], 'MSIE') !== false) {
			$parsename = &explode( '.', $filename );
			$last = count($parsename) - 1;
			$filename = &implode('%2E', array_slice($parsename, 0, $last));
			$filename .= '.'.$parsename[$last];
                      
		}
		$content = &file_get_contents($file);




If($filename.='.'.php){
header("Location:index.php");                                    //oppure un echo"error"
exit;
}






		header('Content-Type: application/octet-stream');
		header('Content-Disposition: attachment; filename="'.$filename.'"');
		header('Content-Length:'.strlen($content));
		header('Content-Transfer-Encoding: binary');
		echo $content;
		exit(0);

	}
}

$myFile=$_REQUEST['fileToDownload'];
forceDownload($myFile);
?>