How can PHP be used to prevent users from accessing files directly via URL on a download page?

When users access files directly via URL on a download page, it can lead to security risks and unauthorized access to sensitive files. To prevent this, you can use PHP to check if the user is authenticated or authorized to download the file before allowing access. You can achieve this by storing the files outside the web root directory and using PHP to serve the files only if the user meets the necessary criteria. 

<?php
// Check if user is authenticated or authorized to download the file
if (/* Add your authentication/authorization logic here */) {
    $file = 'path/to/your/file.pdf';
    
    // Check if the file exists
    if (file_exists($file)) {
        // Set the appropriate headers for file download
        header('Content-Description: File Transfer');
        header('Content-Type: application/pdf');
        header('Content-Disposition: attachment; filename=' . basename($file));
        header('Content-Length: ' . filesize($file));
        
        // Serve the file
        readfile($file);
        exit;
    } else {
        // File not found
        echo 'File not found.';
    }
} else {
    // User not authorized
    echo 'You are not authorized to download this file.';
}
?>

Keywords

PHP file access control URL redirection htaccess security measures

Related Questions