PHP: Hide the Real File URL and Provide Download via a PHP Script

There are times when you need to store a file (such as one that you sell for profit) outside of the document root of your domain and let the buyers download it via a PHP script so as to hide the real path, web address or URL to that file. Use of this approach enables you to:

1. Check for permissions first before rendering the file download thus protecting it from being downloaded by unprivileged visitors.
2. Store the file outside of the web document directory of that domain – a good practice in web security in protecting sensitive and important data.
3. Count the number of downloads and collect other useful download statistics.
4. …

Now the actual tip. Given that you have put the file to be downloaded via the PHP script in place at /home/someuser/products/data.tar.gz, write a PHP file with the following content in it and put it in the web document directory where your site visitors can access:

$path = '/home/someuser/products/data.tar.gz'; // the file made available for download via this PHP file
$mm_type="application/octet-stream"; // modify accordingly to the file type of $path, but in most cases no need to do so

header("Pragma: public");
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Cache-Control: public");
header("Content-Description: File Transfer");
header("Content-Type: " . $mm_type);
header("Content-Length: " .(string)(filesize($path)) );
header('Content-Disposition: attachment; filename="'.basename($path).'"');
header("Content-Transfer-Encoding: binary\n");

readfile($path); // outputs the content of the file

exit();

Now your site visitors can and can only download the protected file via the PHP script.

Related Posts

• Simplest PHP Hit Counter or Download Counter – Count the Number of Times of Access (Page Views or File Downloads)
• PHP: Email Attachment Class
• PHP: Why you should use dirname(__FILE__).‘/include.php’ instead of just ‘include.php’
• PHP: File Upload Script (HTML Form + PHP Handler Class)
• PHP: Getting Directory Path and Filename from A Full Path or URL