Handling confidential files

[eluser]sl3dg3hamm3r[/eluser]
Thank you for all your thoughts!

[quote author="Colin Williams" date="1224804954"]Your thinking is spot on.[/quote]

Err.... Sorry I am note native in English and now not sure if this means "Watch out, pitfall" or "yeah that's cool so far". :gulp:

[quote author="Colin Williams" date="1224804954"]The file doesn't necessarily have to be outside of a public folder, you just need to insure PHP handles the request and serves the file, and not Apache.[/quote]

But then, if the files are located somewhere within the html-directory, I would definitely need to protect them with a htaccess, no? PHP only can handle it if it is called. If a file is called directly (assuming somebody found out path and filename), PHP has nothing to do with it anymore and can't give any protection.

Well, to store the files directly into the DB, that's actually also an option...