Creating a download script for a custom online store

I need a download script that will allow only logged in users to download purchased files. Right now the the website allows someone who is logged in to see purchased downloads, but the existing script allows the logged in user to share the hotlink of the MP3 files as seen in attached file. Currently the [login to view URL] file gets the filename from mysql and does header("Location: ".$file); The problem is this approach reveals the file path and name and piracy is problem. I would like the best approach to the [login to view URL] that does not reveal the hotlink to the MP3 files. Renaming the file would also be ideal (eg. [login to view URL] [on server] to [login to view URL] [downloaded])