PHP protected files question

[TooncesLives]

A friend of mine is working on a site that has a very basic "member" section where his client wants to put pdf files that contain machine specs and prices for his products (the customer will then only give the login information to his product dealers). The problem is making sure somone couldn't get to the pdf's without logging in. I found a way to prevent this by setting up an htaccess file in the directory that stores the pdf files, but his web admin won't let him do it this way (he must use the account information in the mysql database, not an apache account). His web admin said he would also prefer it if the files can be stored outside of the webdirectory...I don't know how they could be made available then. Any ideas on how to approach this, or examples that anyone knows of would be great! I'd really like to help him get this taken care of.

 

[fender]

Why not something like...

if (logged in) {
	header("Content-length: $file_size");
	header("Content-type: $file_type");
	header("Content-Disposition: attachment; filename=$file_name");
	readfile ($file_location.$file_name);

} else {
	...
}

 

[Eiolon]

Generally, your files are stored in a public_html folder or something similar. You can store your files up one level in the directory above it. I do that with my database connection script. No one can access the directory above public_html or its files, however, the server can.

 

[PanzerBoxb]

I have been using AjaxFB for some sites where I needed this. It allows you to have your users stored in a database and can access any folder on the system. I am sure there are other solutions available as well.

 

[surazal]

Another option is to store the files in your db as binary data. If you are anticipating lots of downloads though, this might not work since it requires lots of bandwidth between db and webserver.