// assuming we got our query from an htmlspecialchars encoded, slashes added POST
$z = htmlspecialchars_decode(stripslashes($_POST['query']));
$q = mysql_query($z);
$result = '';
 
// add the row headers
$numfields = mysql_num_fields($q);
for ($i=0; $i<$numfields; $i++) {
	$result .= mysql_field_name($q, $i) . "\t";
}
 
/* cycle through the query and add each row, note the casting via &$val and the \t separators for new columns.  Using commas, semicolons, etc. will create a .csv but Excel will not interpret it correctly as an .xls download */
while ($r = mysql_fetch_assoc($q)) {
	$result .= "\n";
	foreach ($r as &$val) {
		$result .= "$val\t";
	}
 
}
 
header('Content-type: application/ms-excel');
header("Content-Disposition: attachment; filename=report.xls");
header("Pragma: no-cache");
header("Expires: 0");
echo $result;