How to setup one time download of your files securely

Jason — Sun, 03 Jan 2010 13:11:00 +0000

If you are selling a digital product and want to offer it for download but are concerned that people will share the URL to the file, you could use a solution like ClickBank. However the advantage of setting up one time downloads from your server instead is that you have more control over what you are selling and you don’t have to pay any fee’s.

Let us assume that you have setup and integrated a payment solution (such as PayPal using the IPN, post coming soon on this) and you have a database setup that holds the payment information.

CREATE TABLE `transactions` (

`id` INT( 5 ) NOT NULL AUTO_INCREMENT PRIMARY KEY ,

`transaction_id` VARCHAR( 50 ) NOT NULL ,

`file_downloaded` TINYINT( 1 ) NOT NULL

) ;

Now we will create download.php which will be the link sent to the user after they have paid to download your files.

To keep it secure you would include the transaction ID (which would be unique to each payment) as part of the query string, so the link would be:

http://www.site.com/download.php?transaction_id=XX

Now you do need the files to be uploaded somewhere on your web server, however the location will never be revealed. The best way is to put them in a folder outside of the web root so that they cant be accessed via HTTP. However if this is not possible then put them in a folder name that cannot be guessed (use a random password generator if you don’t have any ideas).

// Path to the files to be downloaded
$file='/home/usr/files/blah.zip';
// Transaction ID

$transaction_id = $_GET['transaction_id'];
// Connect to database

mysql_connect('localhost', 'user', 'pass');

mysql_select_db('dbname');
// Lookup the transaction ID in the database

$query = sprintf("SELECT * FROM transactions WHERE transaction_id='%s'",

mysql_real_escape_string($transaction_id));

$query = mysql_query($query);

$row = mysql_fetch_array($query);
// Valid transaction ID?

if (!$row) {

  die('Invalid transaction ID!');

}
// File already been downloaded?

elseif ($row['file_downloaded'] == 1) {

  die('File has already been downloaded, please contact us if you have any problems');

}
else {
  // It's a valid transaction, update the database so that we know the file has been downloaded for next time

  $query = sprintf("UPDATE transactions SET file_downloaded = 1 WHERE transaction_id='%s'",

  mysql_real_escape_string($transaction_id));

  $query = mysql_query($query);
  // Now force the file to be downloaded

  header('Content-Description: File Transfer');

  header('Content-Type: application/octet-stream');

  header('Content-Disposition: attachment; filename='.basename($file));

  header('Content-Transfer-Encoding: binary');

  header('Expires: 0');

  header('Cache-Control: must-revalidate, post-check=0, pre-check=0');

  header('Pragma: public');

  header('Content-Length: ' . filesize($file));

  ob_clean();

  flush();

  readfile($file);

  exit();
}

?>

Quick way to INSERT an array into a table

Jason — Wed, 30 Dec 2009 10:10:18 +0000

This is a useful function that I wrote to insert an array into a table in your database.

function insert_array($table, $data) {  

 $cols = '(';

 $values = '(';

 foreach ($data as $key=>$value) { 

  $value = addslashes($value);

  $cols .= "$key,";  

  $values .= "'$value',";  

 }

 $cols = rtrim($cols, ',').')';

 $values = rtrim($values, ',').')';  

 $sql = "INSERT INTO $table $cols VALUES $values";

 mysql_query($sql) or die(mysql_error());

 return mysql_insert_id();

}

Here is an example of using this code:

$arr = array('title' => $_POST['title'], 'product_code' => $_POST['product_code'], 'description' => $_POST['description'], 'price' => $_POST['price']);

$product_id = insert_array("products", $arr);

?>

XEWeb » MySQL

How to setup one time download of your files securely

Quick way to INSERT an array into a table