My original answer:
You will need to store (be in database or session variable) what items the user can access, for each you will generate a unique random token. That token will be used to identify the purchased item. Pass the token to the page where they will be able to download (either in a session variable, a POST argument or, as last option in the url, ie GET). In the page when you need to download you will query the database/session variable using the session information to identify the customer and the passed token (however did you pass it) and with that retrieve what file to download.
If you need to keep a list of purchased items for re-download, you can do so too, but remember to create the tokens again when the user requests the download. You can also add an expiration date if you feel like it.
Now I've mentioned a couple alternatives, then again by the nature of the cited answers I guess you will need more detail in how to do that.
May be ernie is right, and I should not assume you have a session. May be I should show you how to do a session.
So I'll take one of the option to implementation, the simplest option.
<?php
//Oh, I'm in a PHP page...
//check if there is not a session
if (session_id() != '')
{
//Ok, there is no session, let's create one
session_start();
}
//Now we are sure there is a session
//Let's store in the session the id of the file I want to allow to download
$_SESSION['download'] = GetFileId();
//GetFileId will do some mambo jambo expecto patronum to return an id
//The id will be 38a205ec300a3874c867b9db25f47c61 or something
?>
Now in the download page....
<?php
//Oh, I'm in another PHP page...
//check if there is not a session
if (session_id() != '')
{
//no session? screw you, no download for you
header('Location: sorry.php');
}
else
{
//Now we are sure there is a session
//Let's get from the session the id of the file I want to allow to download
$id = $_SESSION['download'];
//Now get the url to redirect to allow the download
$url = GetUrl($id);
//GetUrl will do some mambo jambo expecto patronum to return an url
//Ok, now we are going to return that file...
//So put the correct MIME type
header('content-type: image/gif'); //if it is a gif...
//Load the file
$contents = file_get_contents($url);
echo $contents;
//That's the only output
exit();
}
?>
Please observe that I do allow access to the file only from PHP, so I can verify first if the user has access. You should not allow the user to just put the url (even he cannot guess it) and access the file. So if you are running your server, you want to put those files outside of the server web folder, or if you are using a hosting protected them with .htaccess (or another mechanism your hosting provides).
Comenting on this solution:
It is simple, easy to implement. Yet it has some drawbacks:
- If the session is terminated before the download, the user lost his money*.
- There is no clear way implement a re-download.
- It is still vulnerable to session hijacking (far fetch'd, I know, but better be safe).
*: Say the connection was lost, and the session expired in the client. Oh, no, we don't need no happy customers.
So, you really, really, need to back this up with a database and create random tokens, preferibly with an expiration date.
