fixed.php

<?php
require "php/connect.php";
$hash = $_GET['hash'] ?? false;
if(!$hash) {
    header("Location: /");
    exit();
}
$pdo = new PDO(...);
$prepareOrders = $pdo->prepare("SELECT file FROM zamowienia WHERE hash=:hash");
$prepareOrders->bindParam(":hash",$hash, PDO::PARAM_STR);
$prepareOrders->execute();
$order = $prepareOrders->fetchObject();
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename='.basename($order->file));
header('Expires: 0');
header('Content-Length: ' . filesize($order->file));
$fp = fopen($order->file, 'rb');
fpassthru($fp);
exit();