Adrian, I use something like this: <?php if ( $is_member) // global var set during login { include("/home/belowdocroot/project_a/memberprofile.php"); // or whatever your page is } else { echo "Sorry, members only. Please login or register."; header("location:/members/login.php" ); } HTH Gerry http://groups.yahoo.com/group/php_and_mysql/ On 3/10/06, Adrian Bruce <abruce@xxxxxxxxxxxxxxx> wrote: > > Hi > > After some advice (surprise!) > > I currently store restricted documents beneath the web root so they are > not accessible via the URL, when a valid user wishes to view a document > i copy it to a temporary folder above the root and load it in a new > page. the only way i can then manage to delete the copy is > automatically deleting all temp files when any user goes to the log out > page. > > This is obviously not a very good way of doing this but unless i can > establish when a user is no longer viewing the doc then i dont know when > to delete it. I was wandering how others deal with these problems like > this >