On 26 Feb 2003, Bryce C wrote:

> The file itself is not on the web.  download.php takes a parameter that
> says which file to "pipe" through off the system to the user. I.E. the
> file's at /root/file.tar.gz  There's no way the user can get there w/o
> asking download.php which does have access.

Some browsers may honor  Content-Disposition.

You can read about it in rfc2616, rfc1806, rfc2183

Example:

Content-Type: image/png
Content-Disposition: attachment; filename="fname.ext"

   Jeremy C. Reed
   http://www.reedmedia.net/