Create url alias for download digital products

SundariDevi

I want to sell paid digital downloads on a website.

Right now I'm using E-junkie until I have time to get something up and running, but I'm looking for a solution on how to create a unique download URL for every client who buys a product, keep that url active for x days and/or y download attempts, then expire the url.

I guess this should be some sort of alias to the real file location. I've thought about generating a random url, then storing it in a database and when that url is accessed call the real url and download the file. But how can I be sure the user can't see the real product url?

Bonesnap

You might be able to do something like

download.php?u=42&p=100

Where u is the user ID and p is the product ID. With these pieces of information you can check to see if the user has actually bought the product and if so, offer a download link, otherwise provide a link to your store or print a message, etc.

SundariDevi

@: I can identify whether or not they should be able to access the product from the database, but I want to give them a unique link.

The problem is that if I give them a link to the actual product they could post it in a forum or something.

I suppose one solution could be to copy the file into a temporary directory and let them download it from there while it is valid.

@: Your solution sounds good. What headers do I need to get this to work. I'm not familiar with this

SundariDevi

bradgrafelman;11004176 wrote:
Don't you have some sort of user authentication system? If so, it wouldn't matter if they post the link in the forum, since presumably your user authentication system would have some sort of mechanism to determine if the request is coming from a user who hasn't logged in yet.

Yes, but I didn't know about the readfile() function. I was thinking that they would have direct access to the file location and then the file could be downloaded if they knew the location. I'm still not sure how authenticating can block access in this case.

bradgrafelman;11004176 wrote:
Otherwise, you could generate some long, random hash value and store that value in the database. You could then expire that value either after it is used once (but what happens if they want to pause/resume the download or use a download 'accelerator' ?) or after some period of time.

Don't understand that either! Does this assume that the hash is passed as a parameter and if it doesn't validate then we deny download? Does this assume we are using readfile() as well?

bradgrafelman;11004176 wrote:
The PHP manual page for [man]readfile/man has a coding example to do exactly what I was describing (although I don't normally use ob_clean() or flush()).

This looks interesting. Thanks, I'll look into it

SundariDevi

Thanks for getting me pointed in the right direction.