Directions on designing an upload/download (with password) protected system

Hello everyone! I'm quite new to PHP and I need some directions on the following : I must have a system that enables users login and depending on their access level enable them to upload and download files. Login in and managing sessions I have already covered. What I really would apreciate would be a little help on designing an upload/download procedure. I'm considering using PHP's file and directory capabilities to achieve it. To upload a file I will use a few examples that I have found on www.devshed.com but I want that the upload files to be stored on a directory apart from the web root so that only people with the right access can download them after. When it comes to downloading I'm quite stuck. These files would be located on a directory other that the apache HTML root so tht it would take PHP capabilities to access the file and send it over to the client. How can I do it? Does anyone know of such a system that I would be able to get the code such as those PHP web based e-mail systems? Any help would be apreciated. Thank you very much! Carlos Fernando Scheidecker Antunes.