PHP protecting downloads

Question

I need a method to protect the download URL of a file from being seen by the downloader.

The idea is that the user is given a download link after paying, but to stop them spreading the URL among their friends who haven't paid.

What are some common solutions to this? Possibly changing file name?

(I can do PHP, and mySql this post is for methods really)

Answer 1

If users have an account on your site, stock in your DB if they paid the download. Then give them a link such as download.php where you verify if they paid, and if yes, do a location to the file. Example for a .pdf :

if($userpaid === true) {
  $filename = 'congrat-you-paid-it.pdf'; //Name to display
  $file = './download/pdf/secretlink.pdf';      
  header('Content-type: application/pdf');
  header('Content-Disposition: inline; filename="'.$filename.'"');
  header('Content-Length: ' . filesize($file));
  @readfile($file);
  exit;
}

Answer 2

One solution could be to use SESSION or a similar temporary storage and generate download URLs at run-time. So clicking on the URL again may not work.

Also, direct access to the files should not be allowed.