"indirect" file downloads

[hiwatt]

Hi all,

I need some input on the following issue: I need to create a download area for files to registered users only. Of course, the files should not be 'visible' to any search engine nor to a user who has knowledge of the direct link to the file (I know, not a likely situation).

So, I thought I could put the files into a directory below the document root of the webspace. I do that also for pictures on another site. There, I use a php-script in the SRC option of the IMG-tag that will output the image using the following header:

header("Content-type: image/jpeg");

Now, I guess I can do it similarly using a regular HTML-link and using the according headers. What are these for Word, Excel and PDF's? Can I also alter the file name? Or does anyone have a safer and easier solution?

[AstroTeg]

You'll find all sorts of nifty content types here: http://www.isi.edu/in-notes/iana/assignments/media-types/media-types

Look for msword, excel, and PDF are application content types so check out the application section.

The method you described is really the safest method. Put all the files out side of the web site's root folder and no one can directly access the files. Trick is making your PHP code check to make sure the user has permission to grab the files or not.

[hiwatt]

Thanx for the reply and the confirmation "I am doing it the right way". The setup described works perfect.

I found the posts on the php hompage very usefull for dealing with different browsers and file types. It has some ready to go code there as well: http://ch.php.net/manual/en/function.header.php