print "Content-disposition: inline; filename=$filename\n";

In my experience, if you use "inline", the browser will try to show it itself, but if you use "attachment" instead, it'll download it to disk.

Also, I think it's (probably) safer to quote the filename.

print "Content-disposition: attachment; filename=\"$filename\"\n";
[download]

That's from memory, I haven't rechecked it in practice.

A few online references:

• RFC 2183: The Content-Disposition Header Field
• Microsoft: How To Raise a "File Download" Dialog Box for a Known MIME Type