@goku: OK, you are talking two different things here. WinSCP connects to server software and a website is application software.
This of this forum site. Only Martin has access to the files that make up this website and he might use WinSCP to manage those files. But we all have IDs inside the web application (forum) and we log in with that. Application access and file access are two different animals.
Now if you are looking for how a website might handle file upload and download, check how
phpBB does it. The user ID that owns the phpBB application has permission to upload files. And as a user uploads a file through the phpBB software it is tracked so that the unique file name on the server (not the same as the file name the user used for it) is stored in a DB table. When a user wants to download a file, the list of available files is shown to him (pulled from the DB by SQL according to his permissions) and when he clicks the download link a standard file transfer is kicked off in the web server.
phpBB has all the examples in it you might need, but that software is huge and not a good starting place for a rookie. Here is a link (<invalid hyperlink removed by admin>) to a set of source code that manages user registration and login. And this
link is to a set of source code that lets you do remote file management.
You can also let
Apache manage access directly, but it does not typically keep the ID/PW in a database. Instead it uses a config file in a secure (non-remotely accessible – except by WinSCP and owner ID) area. Some quick google searches did find where someone showed how to manage Apache using a MySQL table (<invalid hyperlink removed by admin>), but it is for a very old version of Apache.
I hope I got the point of your question and provided useful feedback.