It does indeed seem that you are getting close. When you test the rs that is on the checkout success page do you see the results you expect? It is important to ensure that this recordset is working for you before you try to debug the values that are based on it.
As for the link what is the full line of code you have the link on? Can you confirm that you are getting to the download page with a URL parameter that looks like this:
download.php?prodID=9