PHP Script Download Counter

<?php
    //connect database
    mysql_connect("localhost", "username", "password");
    mysql_select_db("dbname");

    $filename = mysql_real_escape_string($_GET['file']);
    $path = "download-files/";
    $fullPath = $path.$filename;

    $filetypes = array("rar","zip","pdf","doc","docx","Xls","xlsx","ppt","pptx","txt"); // daftar ekstensi file yang support
    $ext = end(explode('.', $filename);

    if (!in_array($ext, $filetypes)) {
        echo "Invalid download type.";
        exit;
    }

    if ($fd = fopen ($fullPath, "r")) {
        //add download stat
        $result = mysql_query("SELECT COUNT(*) AS countfile FROM download WHERE filename='" . $filename . "'");
        $data = mysql_fetch_array($result);
        $q = "";

        if ($data['countfile'] > 0) {
            $q = "UPDATE download SET stats = stats + 1 WHERE
            filename = '" . $filename . "'";
        } else {
            $q = "INSERT INTO download (filename, stats) VALUES
            ('" . $filename . "', 1)";
        }

        $statresult = mysql_query($q);

        //the next part outputs the file
        $fsize = filesize($fullPath);
        $path_parts = pathinfo($fullPath);

        header("Content-type: application/octet-stream");
        header("Content-Disposition: filename=".$path_parts["basename"]."");
        header("Content-length: $fsize");
        header("Cache-control: private"); //use this to open files directly
        while(!feof($fd)) {
            $buffer = fread($fd, 2048);
            echo $buffer;
        }
    }
    fclose ($fd);
    exit;

?>