I'm working on uploading some songs to a music website, but I don't want people to be able to download them for free, and using a javascript player, the links will be visible. I understand how I can use some crazy keys to identify the song using a separate php page, for example the link could look like this:

links.php?id=some-ridiculous-id-number

And from there my PHP page would determine which song has that unique identifier to pull the correct song and block attempts to save it. But I want to be able to play it so how can PHP determine if the request is coming from the music player and not someone direct linking to download? I appreciate any help! Security for this type of stuff is not my specialty.

If you are playing the songs with javascript they have already been downloaded.

You don't make any sense. I'm seriously looking for advice. Here's what I've got so far.

PHP Code:

    if(!preg_match('/^[a-zA-Z0-9]*$/i',$_GET['ID'])) die('No illegal characters');
    elseif (strlen($_GET['ID'])==0) die('The text field cannot be empty');
    else $ID = $_GET['ID'];

    $result = $db->getOne("SELECT filename FROM `table` WHERE ID='$ID'");
    $path='http://website.com/foldername/'.$result;

    header('Content-type: audio/mpeg');
    header('Content-Length: '.filesize($path)); // provide file size
    header("Expires: -1");
    header("Cache-Control: no-store, no-cache, must-revalidate");
    header("Cache-Control: post-check=0, pre-check=0", false);
    readfile($path); 


If I visit just the link, it doesn't really play, but from the player it plays just fine. However I'm not sure how reliable this is and I've already found a bug. If a user does try to download the file it saves as a text file with a bunch of junk, but the first line is very easy to understand. It's a php error that gives the real address of where the file is saved. Not really ideal.

That is "serious" advice. To play a music file it HAS to be downloaded to the client FIRST!. End of story.
The headers are located at the END of the file, so they cannot start until the last byte has been downloaded to the client.

IF you do not want the file to download you will have to use a streaming format

Well I would have thought so too but when you talk about it "downloading" don't you mean to the 'temporary internet files' folder? Because if I open that and locate the files, it's saved as this:

mp3.php?ID=eoirhfgvk | Internet Address | MP3 Format Sound | 5,344 KB

So if you click that, it takes you back to the webpage address, runs my script, and still doesn't let you play it. Should I be looking elsewhere? Because I'm unsure how to set up a stream for a single mp3 file. I've got it for a radio feed but thats it.

links.php?id=some-ridiculous-id-number&some_unique_value&hash
generate these values only from server-side (for example, md5($songname.date("d"))) and store these ones, so, when this value reapplied, script must say "sorry, pal, this link was used before"

Files do not always survive in the cache depending on the browser and application and allotted space. They might be there minutes or sometimes days.

How to stream MP3s

Even streaming music can be downloaded, that's not a secure protection.
My advice, either down the quality rate or cut only 30 seconds from a song, that's for preview.

For downloading use other security methods.