Originally posted by feldon23
I would gzip the files and save them with a randomly generated filename. Then I would use some kind of header redirect to an automatic download so it's harder for them to tell where the file is coming from.
unfortunately, header hides the url it was called from, not the one you redirect to.
zipping the files is definitely the best thing to do, but instead of just using a random path name which your users could theoretically pass on to their friends, you could pass a filename variable and use a PHP script to pull the files out of a protected directory using fpassthru(). you could check that they are authorized in the script using sessions or your database, and if so, use:
header( "Content-Type: application/zip" );
header( "Content-Disposition: attachment; filename=".$filename );
fpassthru( $path_to_file );
exit();