title: Block access from direct URL, but not from users in mysql database
body: <p>I have a database named users, with a table named users that contains user/pass/email for people to access my site. The purpose of the website is for musicians to share their music and/or recorded performances with each other. I want to restrict file access to all besides the users in my db/table. </p>
  
  <p>I have the .mp3 files outside of the www directory. I'm currently using this:</p>
  
  <pre><code>&lt;?php
  header('Content-Type: mp3');
  readfile("../Music/" . $_GET['mp3']);
  ?&gt;
  </code></pre>
  
  <p>And to call:</p>
  
  <pre><code>&lt;a href="music.php?mp3=songnamehere"&gt;Song name here&lt;/a&gt;
  </code></pre>
  
  <p>However, if you know the direct link you can download it w/o any permissions.</p>
  
  <pre><code>example.com/music.php?mp3=songnamehere
  </code></pre>
  
  <p>I have tried to combat this with .htaccess, but still accessible with direct url:</p>
  
  <pre><code># secure htaccess file
  &lt;Files .htaccess&gt;
  order allow,deny
  deny from all
  &lt;/Files&gt;
  </code></pre>
  
  <p>To no avail, I still cannot get it to work. I need something that works with my db/table that has the users/pass/email and blocks direct url access for non users. </p>
  
  <p>Any information you can provide will be a big help. However, I'm not an expert with php so explain as much as you have the effort. Thank you</p>