I want that my users can download quarantined files (having arrived as mail attachment) on their own responsibilities from the mailserver.

To achieve this, I want to offer them a webpage (a form) where they can enter the filename; and submit it to a webserver, which returns them the file. Meanwhile I want to completely hide where the file is served from, i.e. there should not be any actual URL showing the location of the file.

I want to do this with PHP. I never did such thing, so I do not know how to get such request served by a PHP script (Maybe redirection? But I think that would inevitably reveal the URL...).

Could you give me a hint how to do this?

What you need to do is look at the header() function and set the content type to something like "application\octet" and force the web browser to prompt a save dialog. Then, after setting the correct header sequence (I recommend reading www.php.net for information on the header() function), you simply echo out the file's data. Of course this requires you to read the file in. Function fread(), fopen, and fclose() may be of interest here.

Or, if it's any easier, set the header, then just echo(file_get_contents($filename));

Thanks for the tips; they worked!