Links and file security in java servlets

I am using java servlets in a website, and I want to have a page that
displays links to files stored in a location on the server (separate to
public_html for security reasons).

The code I have currently works when just calling one file from one
servlet, but I need a page with a varying number of reports to be
displayed as links. The file names for each of these links is
retrieved from a database. The problem I have is that the global
variable, "project.file", only stores the last row in database's value,
not an individual value (file name) for each link. So every link
displayed on the page links to the same document, even though they are
labelled differently.

Any ideas would be greatly appreciated.

The servlet for displaying the links is as follows:

// connections to database

while (resultSet.next() == true) // database connection that contains
the file details
{
    if (resultSetColours.first()) // used only to compare values
    {
        // Initialising values from database
        String id = resultSet.getString("H5_PROJECT_ID");
        String title = resultSet.getString("H5_PROJECT_TITLE");
        String colour = resultSet.getString("H5_PROJECT_COLOUR");
        String date = resultSet.getString("H5_PROJECT_DATE");
        String link = resultSet.getString("H5_PROJECT_LINK");
        String summary = resultSet.getString("H5_PROJECT_SUMMARY");

        session.setAttribute("project.file", link); // setting the global
variable to be referenced in servlet below
        session.setAttribute("project.date", date);

        String r = resultSetColours.getString("H5_R");
        String y = resultSetColours.getString("H5_Y");
        String a = resultSetColours.getString("H5_A");
        String o = resultSetColours.getString("H5_O");
        String g = resultSetColours.getString("H5_G");

        // Output summary link and table headings if this is the first time
through the loop
        if (count == 0)
        {
            // Table headings and formatting
        }

        // HTML table output
        out.println(" <td class='smallfont'> " + id + " </td>\n");
        out.println(" <td> " + title + " </td>\n");

        // Compare value in h5_project database to the static value in the
h5_colour
        if (colour.equals(r))
        {
            // red
        }
        else if ((colour.equals(y)) || (colour.equals(a)) ||
(colour.equals(o)))
        {
            // yellow
        }
        else if (colour.equals(g))
        {
            // green
        }
        else
        {
            // do nothing
        }
        out.println("<a href=/servlets/Project_FileOutput>" + link + "
</a>"); // this calls the servlet below using the global variable.
the problem i have is that the global variable only stores the last row
in database's value, not an individual value (file name) for each link.

    }
}

The servlet for accessing the files from the separate directory is as
follows:

ServletOutputStream out = res.getOutputStream();

HttpSession session = req.getSession(true);
session.setMaxInactiveInterval(1200);
ServletContext context = getServletContext();

String link = (String) session.getAttribute("project.file"); //
retrieves global variable from above servlet

res.setContentType("application/msword");
res.setHeader("Content-Disposition", "attachment; filename=" + link);

FileInputStream infis = null;

try
{
    infis = new FileInputStream("./myserver/website_files/projects/" +
link);

    int c;
    while ((c = infis.read()) != -1)
    {
        out.write(c);
    }
}
catch (IOException e)
{
    res.sendRedirect("/nofile.html");
}
finally
{
    if (infis != null)
    {
        infis.close();
    }
}