password protecting files rather than web pages ...

Hi, I would like to be able to protect files that are downloaded by users. A colleague of mine sort of got this to work with perl. The script is handed the filename as an arg and the script then opens the file and sends it to stdout (i.e. the user) after setting the content type to binary. This works, however the file that the user ends up with always has the name of the script that was used to give them the file. This makes sense I suppose. So, the question is, is there a way of specifying the filename, or some other way of doing this (I'm hoping to use PHP btw)? Hope I'm making myself clear here. Thanks Paul.