Uploading and Downloading Large Files

NeoGeo

I want to start a download site that will let users (subscribers) download files that are about 500MB in size.

Problem #1 - Server

My first thought is that I will need a VPS because I need root access so I can change the ini file to allow large downloads and also have a better control over customization and security (I may be storing credit cards in the near future as well). Problem is, getting a couple hundred gigs of space on a VPS is pretty expensive. So I found a couple other cheap servers with alot of space however they only have basic FTP access (no root or shell access) but has PHP, MySQL, etc.
So I thought maybe I could host the website and application on the VPS, but store the actual files on the other server. Is this a good setup for this type of app?

Problem #2 - Restricting User Access

All of these files will be uploaded through an administrative interface so that they can all have a standardized name (file-$ID.zip for example) and a corresponding database record can be created (so it is searchable on the website). The problem is once a user gets access to the site and purchases one file, what stops him from just changing the URL so that he can download another file? For example if he pays with his CC to download http://mydomain.com/files/file-1.zip what could stop him from simply changing the URL to http://mydomain.com/files/file-2.zip and downloading the second file for free?

Problem #3 - Multiple Files

I want to create a shopping cart that will allow users to add multiple files to their cart and then checkout. With these files being over 500MB, is there someway I can have the server place all of them in a zip file and just have the user download the one zip file? Other than that only thing I can think of is giving them multiple download links if they have multiple files.

Thanks in advance!

dougal85

#1
Pass 🙂

#2
Grant them access to a directory, then when the download starts deny them access to directory browsing. Also, attempt to give the files a GUID (Globally Unique ID). So they cant easily guess the names of them. Google it, i'm sure there will be examples somewhere. GUID's are generally 32 characters HEX. So the possible combinations are incredbly high - i'm not working that one out 🙂. They will end up looking a bit like a md5 hash does.

http://www.planet-source-code.com/vb/scripts/ShowCode.asp?txtCodeId=957&lngWId=8

MarkR

Using a shared hosting provider is a false economy- if you are technically competent on the system adminstration side, ALWAYS use a dedicated (or dedicated virtual) server.

Those crappy halfway house "Virtual root" servers are a pile of poo - steer clear of them.

Anything which has Ensim control panel, CPANEL etc, steer well clear of them - they've got more security holes than a cullinder and they install bastardised versions of all the packages, resulting in unexpected problems.

If you want proper control of the production server environment, GET A DEDICATED SERVER - they're not expensive.

Of course you should be competent to set it up (or hire someone who is) - and set your development server up as close as you can to the real config - which will save a lot of headaches.

Mark