mysql - PHP: How to protect digital products(video, audio, ebook, etc.) from unathorized downloading? -

this question has answer here:

• php: how access download folder outside root directory? [duplicate] 2 answers

how protect digital products(video, audio, ebook, etc.) unauthorized downloading? i'm using apache server , php/mysql. please help!

thanks! paul g.

edited: sorry incomplete question. want avoid other members sharing direct download links files have access non-members. heard can done storing digital products outside root folder, have no idea how implement php.

i'm going assume you're trying protect files should available "logged-in" users... if you're trying stop people downloading files embedded in site there nothing can do.

so, operating on premise you're trying allow file-access/download approved users, best bet serve protected content through php controller file (let's call serve_file.php). store actual files outside public root directory (or other inaccessible folder) or store files blob data in mysql table.

then, when user wants download file provided link serve_file.php _get data identifies file they're trying get:

http://mysite.com/serve_file.php?file_id=24, instance.

the serve_file.php script takes _get data, figures out file it's indicating, , checks permissions table (or checks see if user logged in) , decides whether user eligible receive file. if are, gets file data (either mysql or file_get_content()), spits out appropriate headers (depending on type of file you're serving up) , print/echos content:

//check user logged in (i'm assuming have function of name) if (!user_logged_in()){    die('you not have permission! please log in'); }  /*see file user trying get...  simple sample can pdfs. should have table file details*/ $file_location = $_server['document_root'].'/../protected_files/file_'.intval($_get['file_id']).'.pdf' if (!is_file($file_location)){    die('could not file!'); }  $content = file_get_contents($file_location); header("content-type: application/pdf"); header("content-length: ".strlen($content)); //add more headers here, deal caching, etc echo $content; die(); 

the headers you've set tell user's browser how should interpret data you're sending (for instance, content-type: application/pdf) , you've allowed authorized users accessing document because have go through php authentication script.