A possible solution is indeed to create a PayPal button. After the user has made the payment you can redirect him/her to a custom page which tells them they have successfully made the payment. You can let PayPal post the payment data to this page and you can verify this way that indeed the payment has been done successfully.
If so, you can set a SESSION or COOKIE variable and on your "target" page (the one they can only access after paying) you can verify if the SESSION or COOKIE has been set or not. If not, redirect them to the payment page.
Example
Make use of something like:
<form action="https://www.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="return" value="http://www.yourwebsite.com/index.php?payment=success" />
</form>
So after the payment has been done the user is redirected to index.php?payment=success and there you read the post from PayPal:
<?php
$req = "cmd=_notify-synch";
$tx_token = $_GET['tx'];
$auth_token = "<your auth token here>";
$req .= "&tx=$tx_token&at=$auth_token";
//Post back to Paypal system to validate:
$header .= "POST /cgi-bin/webscr HTTP/1.0\r\n";
$header .= "Content-Type: application/x-www-form-urlencoded\r\n";
$header .= "Content-Length: " . strlen($req) . "\r\n\r\n";
$fp = fsockopen('ssl://www.paypal.com', 443, $errno, $errstr, 30);
if (!$fp) {
//HTTP ERROR
}
else {
fputs($fp, $header . $req);
//Read body data:
$res = '';
$headerdone = false;
while (!feof($fp)) {
$line = fgets($fp, 1024);
if (strcmp($line, "\r\n") == 0) {
$headerdone = true;
}
else{
$res .= $line;
}
}
//Parse the data:
$lines = explode("\n", $res);
$keyarray = array();
if (strcmp($lines[0], "SUCCESS") == 0) {
//Checks the payment_status is completed
//check that txn_id has not been previously processed
for ($i = 0; $i < count($lines); $i++) {
list($key, $val) = explode("=", $lines[$i]);
$keyarray[urldecode($key)] = urldecode($val);
}
}
//Process payment:
$firstname = $keyarray['first_name'];
$lastname = $keyarray['last_name'];
//etc... you can either insert the payment data into your database for future reference
//Or set up a COOKIE for the user to be able to download your file.
//Or if your payment has been successful, redirect him to a "secret" page where the file is visible.
}
?>