Question

Is there anyway that I can “block” a user from downloading a PDF file on my server using PHP script? That is, to run a MySQL query when the file is being requested, authenticate the user (through a cookie and MySQL query match) and only if the user is authenticated, to serve him the file.

Thanks,

Joel

Answer 1

The general technique is to put your downloadables outside the document root, and then allow access via a PHP script, e.g. something like this…

 if ($authenticated)
 {
     //name of download - e.g. leaf name of file
     //we strip nasties out of it...
     $dl=preg_replace('/[^a-z0-9_]/i', '', $_GET['download']);

     //build path to files
     $file="/path/to/my/fies/$dl.pdf"; 

     if (file_exists($file))
     {
         //send the file as our response, with headers to make the client
         //interpret this as a saveable download...
         header('Content-type: application/pdf');
         header("Content-Length: ".filesize($file));
         header('Content-Disposition: attachment; filename="'.$dl.'.pdf"');
         readfile($file);
     }
     else
     {
         //do a 404 not found
         header("HTTP/1.0 404 Not Found");
         echo "Sorry, that file is not available for download";
     }

 }