manipulating files with php

I am creating a CRM system using php for my final year university project. I would like to enable the storing of files on the system. However I want to restrict access to these files according to privilege tables stored in local mysql tables. In order to prevent access to the files by simply typing the url, they would be stored outside the web directory. Is it possible to create a php page which will read a local file from outside the web directory and pass the data straight to the http output, in affect allowing checking of a users status before allowing access to the file? I would be grateful for any suggestions, Thanks, Andrew