php - How to disable downloading a file from your web without a session variable? -

i don't hoy ask question, may repeated. let's see: disable downloading file web without download script (just using url: http://something/file.zip) unless you're registered, php preferably. yes, it's common topic haven't found information! lot of pages this, such uploaded.net. hope understand i'm talking about. thanks!

first , foremost, don't allow direct access file. store outside of web application's root folder, elsewhere on file system, there no link can used download it. because direct access skips php application , interacts web server, has no knowledge of application's session values.

then create "download" script serve file users. such script given identifier file, like:

http://yourserver.com/download.php?file=file.zip 

(important: be careful how identify file. do not blindly let users download whatever want, or can enter longer paths onto url , download any file server. always validate access things first.)

this other php script, except instead of displaying html return file. actual part of outputting file can simple as:

readfile('/path/to/file.zip'); 

you'd want set content headers appropriately, etc. more complete example can found in documentation:

<?php $file = 'monkey.gif';  if (file_exists($file)) {     header('content-description: file transfer');     header('content-type: application/octet-stream');     header('content-disposition: attachment; filename="'.basename($file).'"');     header('expires: 0');     header('cache-control: must-revalidate');     header('pragma: public');     header('content-length: ' . filesize($file));     readfile($file);     exit; } ?>