That's what I'm initially thinking but renamed a file to just .db and it didn't like that either.
I'll try one with a zip and see if that works.
As for the number strategy then why not just obfuscate the whole thing like most sites do.
Something like:
mysite.com/folder/^^*H#%&w208
would equal something like:
mysite.com/folder/mynewfile.zip
The filename ^^*H#%&w208 would be unique maybe use some GUID type filename creator (I'm sure PHP has something like that built-in or someone has created a script for it already)
Then the database stores that unique name AND the real name and when it downloads it to the client it renames it to the real name.
.
