secure content

[jrthor2]

I have a site where users can buy downloadable content (pdf documents). When they submit their order (using paypal), we get an email of what they ordered. What we need to do is, when we get the order confirmation email from paypal, is email the customer back with a url and something like a pin number so that the user can click the email, they go to a page where they enter this pin number, and then they can download their content. My question is really, what the best way to do this would be? I would think that when they enter their pin number, they would go to a page that would only list the pdf's that they ordered so they can't download all the pdf's if they only bought 1 of them. Any ideas on how I could implement this? Also, if someone could give some code on generating a random 8 digit number for the pin, that would be great too.

Thanks

[jrthor2]

anyone have any suggestions.

[etylocus]

Don't know if you still have this problem, but i'll answer it nonetheless.
The way i'll solve it, is having setting up a scheduled task that runs a vbs file or opens an ASP page that reads the paypal emails and emails back the data to the customer.

[jrthor2]

I don't mind sending the emails myself, but the problem I have is how do I send a link to a pdf, or multiple pdf's that goes to a page where they have to enter some sort of 'pin' number, and once the pin is entered, it validates that it is a valid pin number, and the user can then download their pdf?

[etylocus]

Can you be a little more explicit about what part is it that you don't know how to implement?
Briefly, what your task has to do is:

Check for new mails.
Extract customer data from mail.
send mai to customer, with PIN and link to access page.

Then the page for download shoud:
check if the credentials supplied(PIN, email? username?) are ok, and then redirect to proper file.

To avoid somebody stealing your files, you can implement the download in several ways.
You can copy the file to a temporary location (where it would sit for a certain amount of time) or you can open the file, change the ccontent type, and writebinary to the user.

[jrthor2]

I don't need anything that reads the mails and emails the customer, right now anyway. I will send an email to the customer manually.

What I need is a way to generate a 'pin' that would go in the link I email the user, something like www.site.com/products/downloads/page.asp?pin=12345678.
Then, the user is taken to a page where the pin is verified somehow (using an access database I would think) and if the pin is valid, then they can download their file. Once they have downloaded the file, then the pin is no longer valid, so they can only download 1 time.

[etylocus]

Oks. Now where heading somewhere.
Then what you can do is this:
use a string that contains the characters you want ot put in the pin. (something like "1234567890ABCDEFGHYJKLMNOPQRSTUVWXYZ"
generate a random number smaller than the length of the string.
get the character in the string at the position specified by the number
Repeat these last 2 steps as many times as long you want your pin.
Insert the pin in a table, preferable associated with the email (so later you can check that the user is using her pin)
email the link.
When the user access the page, ask for email, check it goes with the corresponding pin, stream file through connection.

[jrthor2]

What if the user purchased multiple pdf files? Then I'd have to have a seperate link with pin for each of them? How could I generate 1 pin and have them enter that pin or their email, and the resulting page show the pdf's they bought to download them? I think maybe I'd have to have a table that listed the pdf's, and an order table that would have a row for each pdf, per pin number. That sound right?

[etylocus]

You could do it that way, but i think it would be better to generate one PIN for each file, because otherwise you have to remember what file got downloaded and what not, referring to that particular PIN.

[jrthor2]

instead of generating the in that way, isn't there a Random function that will generate a random number for me?

[jrthor2]

Ok, I have the database design done, and my backend application to update the database with the pin number, email address, link to pdf, etc. Now, on the page tha customer goes to, they must enter their email and pin. Once it is verified that there is a record in the database for that pin/email address, how do I get the file to the customer? Meaning, instead of taking them to a page with the file link on it, I want to, for example, redirect the user to the pdf that they should get.

Thanks!!