Protecting file downloads

[Vigilante]

Is there any way I can prevent users from downloading files in a directory (via .htaccess or permissions, for instance) and still allow php to send them the file?

[________]

You can create a folder that you protect with htaccess and place the files in that folder, that way users can't download the files. But then you can make PHP copy the file that that user want to download to a new folder, and add a link to that file.

Then create a script that delete all files in that folder that is older then eg. 1 hour - and create a cron job that run that script every 5 minuts.

[drawmack]

or you could just have a php script that downloads the file directly from the protected directory by user headers and fopen

[Vigilante]

I think I like the htaccess solution the best, as it will allow my application to have the greatest portability.

I'll want to use htpassword with some 26 character wacky combination to keep everyone out and php will still be able to send them the file?

[drawmack]

htaccess sends the password in plain text. Just thought you should know.

[olaf]

If you give everyone a password and Login than it is no problem to use .htaccess. But if you want to protect a directory for the public and you have lots of registered users authencitation with htaccess is not the best way if your ISP don't run PHP on APACHE as module.

[Vigilante]

I don't want to actually use the password function I just want to lock anything but php from accessing the files.

[olaf]

You have to know that a serverside scripts can access files in a .htaccess protected directory by using file-functions...