Member Avatar for anamerican

I found this PHP downloader...
I'm using it like this: a person purchases an image going to paypal, then the image is opened to download but I want them to be able to only download it once and only if its been paid.

Thanks for any help

  • 3 Contributors
  • 2 Replies
  • 93 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by TopDogger

Dani AI

Generated

Short practical plan that ties and suggestions together for a single, paid download:

Use a server-side payment confirmation to create a one-time download token, store it with an expiry and a "used" flag, then serve the file only through a PHP script that validates and atomically marks the token as used. This guarantees the file is delivered only after payment and only once (or a small retry allowance).

Typical flow:

  1. When payment is confirmed server-to-server, create a record: transaction_id, product_id, buyer_identifier, token, expires_at, used=0, download_count=0. Send or show the download link that contains that token.
  2. download.php?token=XYZ checks the DB: token exists, not expired, used=0. Atomically mark it used and increment download_count. Stream the file from outside the webroot and log the delivery.
  3. If you want a retry window (as @TopDogger suggested), allow download_count up to N and/or renew the token on failed transfers.

Implementation tips and pitfalls:

  • Generate cryptographically strong tokens: bin2hex(random_bytes(16)).
  • Protect the critical section against race conditions: perform an atomic SQL update and check affected rows rather than relying on separate SELECT/UPDATE steps.
  • Keep files outside the public folder and stream via PHP with proper headers so URLs cannot be guessed.
  • Record the payment transaction id and check for refunds/chargebacks; revoke tokens if a refund occurs.
  • If you want immediate UX after payment, use the payment-return mechanism for an instant token but still verify server-side (webhook/IPN) before finalizing; treat client redirects as untrusted.

Small SQL/logic sketch:

UPDATE downloads
SET used = 1, used_at = NOW()
WHERE token = ? AND used = 0 AND expires_at > NOW();
-- check affected rows == 1 before streaming

Security notes: always use HTTPS, do not rely on referer or client IP for auth, and log attempts for auditing.

Recommended Answers

All 2 Replies

Member Avatar for StatiX

Paypal offers Instant Payment Notification that will let you set it up where you will know the user has paid before downloading or displaying the image. They offer some downloads on their site.

Member Avatar for TopDogger

You might want to consider giving the user a fixed time period to do the download. Some downloads do fail and the user may have to retry.

Most sites that I have used that allow you to purchase and download images do give you 24 hours to do the same download if the first one failed.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.