Why not let the server do the heavy lifting? You oughn't need to do any authorization (not authentication) yourself. As for the script you can make things easier, assuming you're using Apache, if you set it up as a handler for the directory MIME type httpd/unix-directory.

--
I'm not belgian but I play one on TV.