cabalsdemon’s approach gets my vote. Andrew is absolutely right that you could store the entire file in a blob, but as he said, it will hurt performance.
If you choose to implement cabalsdemon’s approach, make sure to store the files outside of the web path (you don’t want people to be able to access them by just typing their location into the url bar. In most cases, this means that they need to be located before (or at the same hierarchy) as your public_html directory (not inside it!).
You would then create a page that verifies that the user should have access to the file and gets the location from the appropriate table. Depending on the type of file, it would then proceed to get the file and display it.
If you aren’t talking about a huge number of files or massive filesizes, using the blob field that Andrew referenced may be a feasible alternative. I would create a separate table just for the files and create a basic id column that has a primary key and is auto-incremented. You would then need to build an additional table that manages your permissions for each file by id. Depending on your implementation, this option may be more secure.