greg252: no-one said anything about not downloading it, just stopping every man and his dog from linking directly to it instead of going through proper channels.
But I agree that without more groundwork, just lobbing a few headers and a call to readfile() (which would satisfy the immediate question) is a basically pointless exercise. So there's no URL directly to the file to link to? Then just link to the script that produces it instead. Okay, so they won't know the "real name" of the file, but if for some reason that's a problem, just rename the file to a fake name (whatever that is) and link to it directly.
