title: How can I allow a user to download a file which is stored outside of the webroot?
body: <p>I am developing a system which allows registered users (who could be anybody) to upload files.  I've block mime-types etc. to attempt to restrict the files to .doc, .docx and .pdf types, but for additional security, they are uploaded to a folder outside the webroot.</p>
  
  <p>Other users can then choose to download the files.  How do I allow them to do that?  Obviously I can't just put in a link to the file, as it's outside the webroot.  I'm not sure how to reach the file though!  I presume I can use the php file functions to get to the file, but how do I then 'serve it up' to the user who has requested it?</p>
  
  <p>What security implications might all of this have?</p>
  
  <p>Thanks.</p>