Wouldn't storing files in a database be an overhead the system could do without?
I am working on a system that does something similar to what Thoand is describing and I stream the files across from an 'inaccessible' directory.
To be honest I have some reservations about the security of my current solution and am keeping an open mind about a better solution.
If you place the files in a directory like:
/home/myfolder/documents/
And you webservers root is:
/home/myfolder/www/
then as far as I can figure it there is no way for a user to access the documents in using their browser. The php-script I use to stream the files across to the users browser is this:
// $filename is the location and filename of the file to stream
// $realfilename is the name which the user is prompted to save
// under
header("Cache-control: private;"); // fix for IE
header("Content-type: multipart/mixed; boundary=\"simple boundary\";"); // fix for IE
header("--simple boundary");
header("Content-Type: Text/plain;");
header("testing");
header("--simple boundary");
header("Content-Type: application/word;");
header("Content-Length: ".filesize($filename).";");
header("Content-Disposition: attachment; filename=".$realfilename.";");
$fp = fopen($filename, 'r');
fpassthru($fp); // CORRECT
fclose($fp);
header("--simple boundary");
Remember that there must be no output to the browser before you send headers, not even whitespace in front of your php script.
Hope this helped. Hope someone shoots my crappy security solution down with something more explicitly safe.
😉
