User upload file above web root with php

Question

I have a website where local bands can have a profile page, I'm implementing an upload system so that they can add songs to their profile.

I want to make sure that clever visitors to my website cannot download their songs.

I was thinking about uploading them to above the folder for my domain so that they cannot be accessed directly. Is this a good idea and/or possible? If not, what do you suggest I do to try and avoid users downloading songs. I'm already using a flash player to try and prevent downloads.

Answer 1

You can use dynamic url's for songs. I mean, instead of reaching the song as /mp3s/someband.mp3, you can generate a dynamic script such as

findmp3.php?param=dfsdfdsfedfew87rfy2348rf48fg834 

where param will be some hashed data which includes the real path to the file and the haching key is differeent for each request

so even i find that urla and copy and paste it to some download client, it wont work because the key you used for the first time is already used and you wont allow it at the second time.

For encoding the param, you can use mcrypt

Answer 2

You won't stop the very clever as any uri can be intercepted by the user before it's sent and then used as he sees fit. Other users will simply resort to using software to record the song as it plays in their system.

Typical blockades to thwart the less clever (by making uri collection very difficult) are one-time use uri's and streaming servers.