Authorised access to documents

I'm using PHP to upload documents to a server with a link to the
document in a mySQL database. I have a script that then allows
authorised access to these documents later. What I want to do is
ensure that access to the document is only available to authorised
individuals.

In PHP I can control access to the script, but as soon as I put a link
to the document on the server on the webpage such as <a
href='myDoc.doc'>Doc</a> anyone can get direct access to the document
without any checking on status (eg just entering
http://www.location.here/myDoc.doc in the address bar).

What's the best way to control access to myDoc.doc so only authorised
people can get access to it? I need to do this programmatically so
setting file permissions by hand isn't an option. For DB efficiency
I'd prefer not to put the document as a BLOB object in the database.


Saul

Another way would be to wirte .htaccess Files dynamicly, and add
generated Username and Password to the link. (For example:

http://8961ijh:891u23n@www.location.here/myDoc.doc

)

So nobody can guess the files Location. (well, the Location but not the
password and username)


Not in my trousers wrote:

> "Saul" <saul.dobney@dobney.com> wrote in message
> news:c9674c2a.0307300045.2d744eba@posting.google.c om...
>
>>I'm using PHP to upload documents to a server with a link to the
>>document in a mySQL database. I have a script that then allows
>>authorised access to these documents later. What I want to do is
>>ensure that access to the document is only available to authorised
>>individuals.
>>
>>In PHP I can control access to the script, but as soon as I put a link
>>to the document on the server on the webpage such as <a
>>href='myDoc.doc'>Doc</a> anyone can get direct access to the document
>>without any checking on status (eg just entering
>>http://www.location.here/myDoc.doc in the address bar).
>>
>>What's the best way to control access to myDoc.doc so only authorised
>>people can get access to it? I need to do this programmatically so
>>setting file permissions by hand isn't an option. For DB efficiency
>>I'd prefer not to put the document as a BLOB object in the database.
>>
>>
>
> Keep myDoc.doc in your private filestore (out of web directory) and use a
> download script to deliver it..
>
>