diff --git a/newznab/controllers/Users.php b/newznab/controllers/Users.php
index 39c926f63..a7c2d2422 100644
--- a/newznab/controllers/Users.php
+++ b/newznab/controllers/Users.php
@@ -1022,7 +1022,7 @@ class Users
 	 *
 	 * @param int $userID
 	 *
-	 * @return array|bool
+	 * @return int
 	 */
 	public function getDownloadRequests($userID)
 	{
@@ -1033,12 +1033,13 @@ class Users
 				$userID
 			)
 		);
-		return $this->pdo->queryOneRow(
+		$value = $this->pdo->queryOneRow(
 			sprintf(
 				'SELECT COUNT(id) AS num FROM userdownloads WHERE userid = %d AND timestamp > DATE_SUB(NOW(), INTERVAL 1 DAY)',
 				$userID
 			)
 		);
+		return ($value === false ? 0 : (int) $value['num']);
 	}
 
 	public function getDownloadRequestsForUserAndAllHostHashes($userid)
diff --git a/www/pages/getnzb.php b/www/pages/getnzb.php
index 798466260..1732aa8e6 100644
--- a/www/pages/getnzb.php
+++ b/www/pages/getnzb.php
@@ -9,8 +9,8 @@ $uid = 0;
 // Page is accessible only by the rss token, or logged in users.
 if ($page->users->isLoggedIn()) {
 	$uid = $page->users->currentUserId();
-	$maxdls = $page->userdata["downloadrequests"];
-	$rsstoken = $page->userdata['rsstoken'];
+	$maxDownloads = $page->userdata["downloadrequests"];
+	$rssToken = $page->userdata['rsstoken'];
 } else {
 	if ($page->settings->getSetting('registerstatus') == Settings::REGISTER_STATUS_API_ONLY) {
 		$res = $page->users->getById(0);
@@ -29,8 +29,8 @@ if ($page->users->isLoggedIn()) {
 		}
 	}
 	$uid = $res["id"];
-	$rsstoken = $res['rsstoken'];
-	$maxdls = $res["downloadrequests"];
+	$rssToken = $res['rsstoken'];
+	$maxDownloads = $res["downloadrequests"];
 }
 
 // Remove any suffixed id with .nzb which is added to help weblogging programs see nzb traffic.
@@ -45,17 +45,26 @@ if ($page->settings->getSetting('storeuserips') == 1) {
 	$hosthash = $page->users->getHostHash($_SERVER["REMOTE_ADDR"], $page->settings->getSetting('siteseed'));
 }
 // Check download limit on user role.
-$dlrequests = $page->users->getDownloadRequests($uid);
-if ($dlrequests['num'] > $maxdls) {
+$requests = $page->users->getDownloadRequests($uid);
+if ($requests > $maxDownloads) {
 	header("X-DNZB-RCode: 503");
 	header("X-DNZB-RText: User has exceeded maximum downloads for the day!");
 	$page->show503();
 }
 
+if (!isset($_GET['id']) || !ctype_xdigit($_GET['id'])) {
+	header("X-DNZB-RCode: 400");
+	header("X-DNZB-RText: Bad request! (parameter id is required and must be hexadecimal or numeric)");
+	$page->show403();
+}
+
+// Remove any suffixed id with .nzb which is added to help weblogging programs see nzb traffic.
+$_GET['id'] = str_ireplace('.nzb', '', $_GET['id']);
+
 // User requested a zip of guid,guid,guid releases.
-if (isset($_GET["id"]) && isset($_GET["zip"]) && $_GET["zip"] == "1") {
+if (isset($_GET["zip"]) && $_GET["zip"] == "1") {
 	$guids = explode(",", $_GET["id"]);
-	if ($dlrequests['num'] + sizeof($guids) > $maxdls) {
+	if ($requests['num'] + sizeof($guids) > $maxDownloads) {
 		header("X-DNZB-RCode: 503");
 		header("X-DNZB-RText: User has exceeded maximum downloads for the day!");
 		$page->show503();
@@ -73,66 +82,61 @@ if (isset($_GET["id"]) && isset($_GET["zip"]) && $_GET["zip"] == "1") {
 			}
 		}
 
-		$filename = date("Ymdhis") . ".nzb.zip";
 		header("Content-type: application/octet-stream");
-		header("Content-disposition: attachment; filename=" . $filename);
-		echo $zip;
-		die();
+		header("Content-disposition: attachment; filename=" .  date("Ymdhis") . ".nzb.zip");
+		exit($zip);
 	} else {
 		$page->show404();
 	}
 }
 
-if (isset($_GET["id"])) {
-	$reldata = $rel->getByGuid($_GET["id"]);
-	$nzbpath = $nzb->getNZBPath($_GET["id"]);
+$nzbPath = (new NZB($page->settings))->getNZBPath($_GET["id"]);
+if (!file_exists($nzbPath)) {
+	header("X-DNZB-RCode: 404");
+	header("X-DNZB-RText: NZB file not found!");
+	$page->show404();
+}
 
-	if (!file_exists($nzbpath)) {
-		header("X-DNZB-RCode: 404");
-		header("X-DNZB-RText: NZB file not found!");
-		$page->show404();
+$relData = $rel->getByGuid($_GET["id"]);
+if ($relData) {
+	$rel->updateGrab($_GET["id"]);
+	$page->users->addDownloadRequest($uid, $relData['id']);
+	$page->users->incrementGrabs($uid);
+	if (isset($_GET["del"]) && $_GET["del"] == 1) {
+		$page->users->delCartByUserAndRelease($_GET["id"], $uid);
 	}
+} else {
+	header("X-DNZB-RCode: 404");
+	header("X-DNZB-RText: Release not found!");
+	$page->show404();
+}
 
-	if ($reldata) {
-		$rel->updateGrab($_GET["id"]);
-		$page->users->addDownloadRequest($uid, $reldata['id']);
-		$page->users->incrementGrabs($uid);
-		if (isset($_GET["del"]) && $_GET["del"] == 1) {
-			$page->users->delCartByUserAndRelease($_GET["id"], $uid);
-		}
-	} else {
-		header("X-DNZB-RCode: 404");
-		header("X-DNZB-RText: Release not found!");
-		$page->show404();
-	}
+// Start reading output buffer.
+ob_start();
+// De-gzip the NZB and store it in the output buffer.
+readgzfile($nzbPath);
 
-	// Start reading output buffer.
-	ob_start();
-	// De-gzip the NZB and store it in the output buffer.
-	readgzfile($nzbpath);
+// Set the NZB file name.
+header("Content-Disposition: attachment; filename=" . str_replace([',', ' '], '_', $relData["searchname"]) . ".nzb");
+// Get the size of the NZB file.
+header("Content-Length: " . ob_get_length());
+header("Content-Type: application/x-nzb");
+header("Expires: " . date('r', time() + 31536000));
+// Set X-DNZB header data.
+header("X-DNZB-Failure: " . $page->serverurl . 'failed/' . '?guid=' . $_GET['id'] . '&userid=' . $uid . '&rsstoken=' . $rssToken);
+header("X-DNZB-Category: " . $relData["category_name"]);
+header("X-DNZB-Details: " . $page->serverurl . 'details/' . $_GET["id"]);
+if (!empty($relData['imdbid']) && $relData['imdbid'] > 0) {
+	header("X-DNZB-MoreInfo: http://www.imdb.com/title/tt" . $relData['imdbid']);
+} else if (!empty($relData['rageid']) && $relData['rageid'] > 0) {
+	header("X-DNZB-MoreInfo: http://www.tvrage.com/shows/id-" . $relData['rageid']);
+}
+header("X-DNZB-Name: " . $relData["searchname"]);
+if ($relData['nfostatus'] == 1) {
+	header("X-DNZB-NFO: " . $page->serverurl . 'nfo/' . $_GET["id"]);
+}
+header("X-DNZB-RCode: 200");
+header("X-DNZB-RText: OK, NZB content follows.");
 
-	// Set the NZB file name.
-	header("Content-Disposition: attachment; filename=" . str_replace([',', ' '], '_', $reldata["searchname"]) . ".nzb");
-	// Get the size of the NZB file.
-	header("Content-Length: " . ob_get_length());
-	header("Content-Type: application/x-nzb");
-	header("Expires: " . date('r', time() + 31536000));
-	// Set X-DNZB header data.
-	header("X-DNZB-Failure: " . $page->serverurl . 'failed/' . '?guid=' . $_GET['id'] . '&userid=' . $uid . '&rsstoken=' . $rsstoken);
-	header("X-DNZB-Category: " . $reldata["category_name"]);
-	header("X-DNZB-Details: " . $page->serverurl . 'details/' . $_GET["id"]);
-	if (!empty($reldata['imdbid']) && $reldata['imdbid'] > 0) {
-		header("X-DNZB-MoreInfo: http://www.imdb.com/title/tt" . $reldata['imdbid']);
-	} else if (!empty($reldata['rageid']) && $reldata['rageid'] > 0) {
-		header("X-DNZB-MoreInfo: http://www.tvrage.com/shows/id-" . $reldata['rageid']);
-	}
-	header("X-DNZB-Name: " . $reldata["searchname"]);
-	if ($reldata['nfostatus'] == 1) {
-		header("X-DNZB-NFO: " . $page->serverurl . 'nfo/' . $_GET["id"]);
-	}
-	header("X-DNZB-RCode: 200");
-	header("X-DNZB-RText: OK, NZB content follows.");
-
-	// Print buffer and flush it.
-	ob_end_flush();
-}
\ No newline at end of file
+// Print buffer and flush it.
+ob_end_flush();
\ No newline at end of file