Hiding the link to a program

In this case one option may be to create a validation form that the customer enters a 10 character code in. This can be passed back to a php script that would check the code in a text/db file where you will already have entered it. Once the download is complete then flag that code as used. This prevents multiple downloads and random guesses.

Jeremy

You could have a php page stream the file to the browser by sending the appropriate headers, I can't remember what you have to set off-hand but http://www.php.net has documentation about this and I'm sure a few people round here know.

That handles stopping the user knowing where the file itself is, and for the page that sends it, you could set up a simple authorisation system that checks that they've actually paid for the product, and again this is relatively easy to set up.

That's my $0.02 anyway.

You could open the file to download in an invisible iframe:

Or alternatively use JavaScript's window.open to open a window with no address or title bar.

Using PHP command and some program / data logic you can achieve that. Essentially the PHP script (say Download.php?file=xxxxx) will verify that the user is authorized to download the file and translate xxxx into an appropriate file outside the document root directory (which is served by the Web server, like Apache) and then execute the following:

header('Content-Type: application/octet-stream');
header('Content-Length: '.filesize($file));
header('Content-Disposition: attachment; filename="'.$fn.'"');
readfile($file);

where $fn is the filename as exposed to the visitor and $file is the full operating system name for the file.

Let me know if you need more info.

Best of luck.

I am assuming thtat the purchasing of the game is made through the clients browser. In that case you could use a simple javascript to drop a cookie on their system. When the download page was accessed the cookie would be looked for, and if it existed then the download would commence.
Of course you would need to warn clients not to clear their cache before proceeding with the download.
Assuming that the user will download using the same internet session you could log their IP address into the cookie, and validate that before downloading would commence.

If you have any questions just e-mail me back.

What you're looking for, a URL that can't be handed off, is possible with a "Dynamic URL".

The URL for the file could be something like:
"http://www.builder.com/DynamicURL/?auth=as0d87asld20834rasdlr7"

The "auth" parameter would be generated anew with each authenticated download - and then immediately discarded. If the users request additional downloads, they will have to re-authenticate themselves each time.

A similar result would be achieved with the cookie method, but that requires the client to be willing AND able to accept your site's cookies.

Encryption can also be useful (re: SSL). If you want an additionl layer of security, to keep "sniffers" from hooking onto other people's downloads, or to prevent IP spoofers from hacking the authentication process - you can install an SSL certificate, and use an "httpS://" url.

To do exactly what you want to do, I use PHP sessions.
The user auth itself, and I then start a PHP session and place a
session number I generated in his session (which is saved in a
cookie on his station or on the server if he doesn't accept
cookies, but you don't have to mind that. PHP sessions handles
that automatically). Once the session number is saved in his
session, all i have to do when he tries to use download.php is
check his session id with my database (where I inserted the
session id on login) to see if he has the rights to download the
file he's asking for. If so, download.php read the file and send it
to him using the techique described by SSR. If not, I simply echo
an error message or send him to another page with
header("Location: ...")