Well, firstly, the browser needs to know the location of the file to download it. Anyone who opens a standard browser, such as Firebug, will be able to see the URL of your file in text format.
Now, I suppose, you want to protect your file from unauthorized downloads. If this is what you want, there is a way to use the session.
On the first page, you put your code to check if the download is allowed. Then you will enter a current session with something that identifies the file. Everything that is unique to the file will be done, for example, by the database identifier.
$_SESSION['download_key'] = time();
Then you redirect to a page with an html meta-tag like this
<meta http-equiv="refresh" content="5;/download.php?file=download_key" />
This is the page where you say: "Thank you, wonderful guy for downloading my wonderful file." Note that you can also put the contents of the "content" attribute in the header file if you wish, for example
header('Refresh: 5;/download.php?file=download_key');
Note that 5 is the number of seconds until the download file dialog box appears.
Then on download.php you will do the following:
1- Check which file was requested with $ _GET ['file'].
2- Then you check if the download_key file exists in the session. If not, you exit the script this way
if (!isset($_SESSION['download_key'])) die('Unauthorized');
3- Then you check if the time stamp is older than any arbitrary time limit. Here from 30 s
if ($_SESSION['download_key'] - time() > 30) die('Unauthorized');
4- Finally, if everyone exits, you send such a file
header('Content-disposition: attachment; filename=myfile.ext'); header('Content-type: bin/x-file-type'); //Change for the correct mimetype readfile('myfile.ext');
After reading the file, you put the code to set the download to 1 in the database.
And that he, the secure file download and anyone using the URL, would be welcomed with large “unauthorized” text.
I would also like to add that if you have a large file (more than a few kilobytes), you might be better off disabling output buffering, as this would mean that php will keep a copy of the file in memory for the entire download period. Using the readfile function, php will send it to the browser when it reads it on disk and, therefore, will use less memory (and will start sending data earlier).
EDIT: What makes it work:
I actually reversed the sequence: the visitor is first redirected to the thank you page containing the Refresh header / tag. The magic of the Refresh header is that it redirects AFTER the content is loaded. After viewing the thank you page, the browser, after seeing this heading, wait for the specified time, showing the page, and then redirected to download. After redirecting, the browser sees that its file will be downloaded and instead of changing the page, it simply displays the download file dialog box. As soon as the user clicks OK, the download will begin, but he will remain on the same page.
In short, you do not need to redirect after downloading the file, since you are already on the thank you page! I don’t think you can even redirect it after downloading the file. See what happens when you click on a link pointing to a direct file on a web server. The browser requests to download, but does not disable navigation. As soon as the download starts, you can happily move away from the page with the link. When the download is finished, you may be on a completely different website. That’s why you can only show a thank you page. But if you put a zero for the title / update tag, the download prompt will appear immediately after the page loads, so it’s almost the same as if they were at the same time (in the eyes of the visitor)