You can "hide" the filenames by doing an url mask and by using a temporary filehandle. Here's an example. It's not MySQL, but it's the general idea:

#!/usr/bin/perl

use strict;
use warnings;
use CGI qw(param);
use CGI::Session;

my $session = CGI::Session->new();
$session->expire('5m');
$session->param( 'TestName', 'TestValue' );
my $sessionid = $session->id;
$ENV{REMOTE_ADDR} = '127.0.0.1';
$session->flush;

$session = CGI::Session->new($sessionid);
CGI::Session->import('-ip_match');
$CGI::Session::IP_MATCH = 1;
print "IP_MATCH is turned on\n";
 
if (my $cse = CGI::Session->load($sessionid)) {
     print "Session loaded\n";
}
else {    
     die CGI::Session->errstr();
}
print $sessionid, "\n";

my $dir     = '/root/Desktop';
my $file_id = param('/id_mod');

open my $fh, '<', $dir or die $@;
my @fileholder = <$fh>;
close $fh;
print "Content-Type:application/x-download\n";
$session->flush;
[download]

Updated: took out unnecessary code.