.htaccess - PHP: Allow file download to a authorized members only -

i have website , want registered members download particular file. have following structure:

in directory having original setup file, created .htaccess file with:

order deny,allow deny 

and, file called download.php, call file using:

<?php $filename = "127.0.0.1/eye/setup/setup.msi"; if(ini_get('zlib.output_compression'))ini_set('zli b.output_compression', 'off'); header("pragma: public"); header("expires: 0"); header("cache-control: must-revalidate, post-check=0, pre-check=0"); header("cache-control: private",false); header("content-type: application/octet-stream"); header("content-disposition: attachment; filename=\"".basename($filename)."\";" ); header("content-transfer-encoding: binary"); header("content-length: ".filesize($filename)); readfile("$filename"); exit(); ?> 

but, problem is: if knows exact location of file, he/she can setup similar php file on his/her server, passing $filename original location. so, how can rely on script security?

is there else strategy ?

one solution keep download folder outside documentroot. , download.php read using local path:

$filename = "/path/to/eye/setup/setup.msi"; // or build filename using $_get 

then php code read content of desired file local path , set appropriate content type.