document security when using sessions

[timj]

Can anyone please help me?
Suppose I'm using sessions to secure my site (eg a user login). What can I do then to secure my documents, so that some documents are viewable all the time and some documents require a login?
If I just put the documents in the doc root with permissions open to the Apache user, anyone who "accidentally" types in the right URL can look at the document, even without session/login. Of course, this can't be permitted.
But how can I secure the documents?
I suppose that a solution would be to put them in a specially protected directory. But this means that I can't use ordinary links to the documents and I need some PhP script to get the documents (eg with the document name as Post variable). Does anyone have some clues as to how I can make a script (that verifies the session) present documents to the user? Are there any limitations on the file formats used?

[jcantrell]

I have my login script in a file called login.php, it checks to see if there is a username and password stored in the current session, if there is, it collects some information, and continues the page.

If there is no username or password present, it dies and shows a form asking for the username and password.

I just
include ("./login.php");

in every page that I want password protected.

After rereading your question, I'm not sure this is what you are asking for. By documents, do you mean like a pdf file available for download?

[timj]

You're right. With documents I mean PDF, .doc, images,... (anything to download). As the website hasn't been created yet, so I don't know which formats will be used or not. But PDFs will be used for sure.