Downloading zip files and securing folders

[eluser]Evil Wizard[/eluser]
store the downloads outside of the web root, that way browsers and bots cannot access your files, and pass the user a link to a download controller that would verify the users id and logged in status before using php to read in the contents of the file to a variable and pass to the download helper. That way you can log which users are downloading the files, which files are the most popular and so on. For Kernals sake though avoid anything along the lines of "../../path/to/download/filename.ext" thats leaving yourself open to... well exploits lol