You can use a wrapper and never expose the files to the user.
Store the files in a directory outside of your web root, then write something like this to serve up the files:
this is from: http://www.phpbuilder.com/forum/archives/2/2000/7/3/102522
There are a few other examples out there but this is pretty simple:
$fp = fopen($url, "r");
Header ("Content-Disposition: attachment; filename=\"$filename\"");
Header ("Content-type: application/octet-stream");
while (!feof($fp)) {
$buffer = fread($fp, 10240);
echo $buffer;
}
