I'm going to bite ...
The PHP script ensures that the file is not accessible from the outside and only for every request with possible authentication. When you see:
download.php?file=sdjasdk.exe
The loading script looks something like this:
<?php
if( $_SESSION['auth'] == TRUE){
$file = fileopen($whatever);
echo "mimetype crap"
}else{
echo "not authorized bozo"
}
?>
Done.
a source
to share