Help with Download Script

[released]

I have a dynamic site that has a paypal store. When a customer purchases a download, the email used for the purchase is used as a username, and I send them an email with the password to the download. The item number is sent to MySQL and I retrieve the password and filepath of the download. If the payment status is "Completed" and the username and password are correct, I wish to initiate the download. However, I am not sure how to initiate this. The downloads will most likely be a .zip file. I keep all downloads in a certain directory, but I do not want the download path to be visible when the download is initiated to prevent unauthorized downloads. What is the easiest way I can accomplish this?

[SharkBait]

I posted my little download script on this thread: http://www.phpfreaks.com/forums/index.php/topic,119653.0.html

It too should give you an idea on how to serve files to a client :)

[released]

Thanks for the response, the readfile(); method did the trick, except for when I use it from flash. This is the example:

// Posted From Flash
$user= $_POST['user'];
$pass= $_POST['pass'];
$number= $_POST['number'];

// Path/Password Query
$storeQuery= "SELECT * FROM `store`WHERE `number`= '".$number."'";
$storeData= mysql_query($storeQuery);
while($storeRow= mysql_fetch_array($storeData)){
            $path= $storeRow['path'];
$password= $storeRow['pass'];
}

// Order Query
$ordersQuery= "SELECT * FROM `orders` WHERE `custEmail` = '".$user."'AND `itemNumber`= '".$number."'";
$ordersData= mysql_query($ordersQuery);
while($ordersRow= mysql_fetch_array($ordersData)){
$itemNumber= $ordersRow['itemNumber'];
$orderStatus= $ordersRow['orderStatus'];
};

// Verification
if($itemNumber== $number && $password== $pass && $orderStatus== "Completed"){
$status= "Success";
echo "&"."downloadStatus=".$status;
readfile($path);
} else {
$status= "Failure";
echo "&"."downloadStatus=".$status;
}

Basically I am retrieving the user's username and password, and item number from flash. With the item number, I query the `store` table and retrieve the filepath and the correct password. Then I query the `orders` table to verify that there is a completed order containing both the user's email AND the item number posted from flash. I then use an "if" statement to check that; 1. The username is correct, 2. The password is correct and 3. The order is complete. If so I wish to execute the download. I get to the point where the status == "Success", but the file download does not begin. However, if I create a new php file with just readfile($path); it works correctly. Is there something I am missing? Also, is this a safe way to execute downloads?

[michaellunsford]

If you're using something like loadvars in flash to attempt the download, then flash is intercepting it. You will probably have to get your verification back, THEN have flash open the download URL in a new window.