Can't execute download.php inf files directory

I am using a php script to download files listed in a node. The files and the download script are located in ../sites/default/files. The php script (download.php) is as follows:

$file = $_GET['file']; 
header ("Content-type: octet/stream");
header ("Content-disposition: attachment; filename=".$file.";");
header("Content-Length: ".filesize($file));
readfile($file);
exit;

In the ../sites/default/files directory there is an .htaccess file:

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files download.php>
SetHandler None
</Files>
Options None
Options +FollowSymLinks

On the Drupal node, I have a link that looks like this (first instance has a space between the .php? and file=):

<a href="sites/default/files/download.php? file=abj20080306.pdf"><b>Sharing a passion for baseball</b></a> by Stephanie Storm. [145 KB]
or
<a href="sites/default/files/download.php?file=abj20080306.pdf"><b>Sharing a passion for baseball</b></a> by Stephanie Storm. [145 KB]

When I was running Drupal 5.16, the script would execute fine and force a download of the file. (I don't want the file to open, but rather to be downloaded.) Now, with Drupal 6.11 the first instance of the link above results in an attempt to download the 'download.php' file. The second instance of the link results in an Internal Server Error (500).

Is there something different between Drupal 5.16 and 6.11 that would cause this behavior?

Thanks for the help.