Posted by Good Man on 05/11/07 20:31

"Zoe Brown" <zoenaomibrown@N-O-S-P-A-A-Mtesco.net> wrote in
news:H831i.3223$o42.590@newsfe3-win.ntli.net:

> Thanks, I think I have decided to go down the .htaccess route. This
> will mean that the user will have to enter a username and/or password
> which will give them access to their link (they need to access the pdf
> via the website) and then once they access the file they will be
> prompted by the sever for username/password again. I think my client
> will live with this.

Sure, they may live with it, but you must recognize its far from ideal.
A username+password system is good, but two systems? For retrieving one
file? It sounds to me like you are forcing your user to deal with this
problem instead of tackling it yourself on the programming side.

Storing the file above the www root and streaming it via PHP is the best
solution for what your client wants... when your system "gets" the PDF
via PHP upload, store it in a folder above 'www' and keep the info in a
database 'files' table (the file name, the real location on the server,
and a bunch of random characters to serve as a key instead of using an
auto-increment ID).

Then, you have a file called "streamFile.php".... your user clicks on
the link "streamFile.php?key=3197fhduabsd", and your script looks up the
file according to the key, then uses readfile(); or a custom function to
stream the file to the browser....

Or, you could go with .htaccess entirely. But using a combo of
..htaccess, sessions and databases to control user access is more often a
headache than not. And asking people to enter a username/password more
than once is incredibly annoying and bad user interface design.

Good luck!

[Back to original message]