---
name: feedback-php-ob-export
description: PHP file export/AJAX handlers that run after ob_start()+header.php must call ob_end_clean() before sending headers
metadata:
  type: feedback
  originSessionId: 002fe81e-7e03-414d-b842-1f94f1390a22
---

When a PHP admin page uses the pattern `ob_start()` + `require_once header.php` at the top, any handler that sends a non-HTML response (CSV download, JSON AJAX, redirect) must call `ob_end_clean()` before setting Content-Type headers and outputting content.

**Why:** `ob_start()` buffers everything. `require_once header.php` fills the buffer with a full HTML page before any request-type checks run. Without `ob_end_clean()`, the browser receives the full HTML page *followed by* the CSV/JSON body — the export appears to download the entire rendered page instead of the file.

**How to apply:** Any time I add a file export or AJAX handler to an admin page that uses this pattern:

```php
// ✅ correct
if (isset($_GET['export'])) {
    ob_end_clean(); // discard buffered HTML from header.php
    header('Content-Type: text/csv; charset=UTF-8');
    header('Content-Disposition: attachment; filename="export.csv"');
    // ... output CSV ...
    exit;
}

// ✅ correct for AJAX
if ($action === 'inline_edit') {
    ob_end_clean();
    header('Content-Type: application/json');
    echo json_encode(['ok' => true]);
    exit;
}
```

First discovered and fixed in `admin/import-export.php` on tomsjavajive.com (2026-05-22).