Images Upload Password Protect

I'm concepting a system in php that offers user level password protected upload / download of image files - certain users would only be able to access certain files. The file sizes could be anywhere from 1mb on up to 25mb. I am thinking of storing the (user uploaded and downloadable) files outside of the www directory (if that is possible with php) and using mysql to track files and associate them with users. I would like to pose a few questions: 1. How would you get around scrip timeouts on huge 25mb files. 1a. In a virtually hosted situation, how much php can a server provide if 5 people are tying up connections/php with 25mb downloads. 2. If it is possible to upload files outside of the www directory via php, would this bring added security concerns to the site. I don't wan't the files to be browseable by J.Q. Public. 3. Is there a better solution using straight ftp connections that could also provides user level password protection - keeping in mind that users would need the capacity to create an account and upload a file without an administrator having to create directories and passwords. Thanks in advance for any ideas/opinions/etc. Kevin