Binary Images and Wriatble folder

[charonlee]

Hi,

As we know, we be able to save our images to database by saving their binary data or image path. If we save the binary data we needn't to save the images in image folder. I'm curious to know, which is the best practise?

By saving their binary data, when retrieve the image, I must use the content type Response.ContentType = "image/jpeg" , due to this, the page that I use to display the image can't be use to display their Description as well such as image name and details of the image.

I use this method (OLE object) is because we don't want to create a writable folder for saving the images. (the images are uploaded by users) .

1.) I want to know Due to I allow users to upload images/files into my web-site, so I have to set a folder which name uploadfile to be writable. But, my concern is would it be a problem? I mean security problem. As we know that window 2000k has provided a lot of folder's permission such as Folder Full Control, Modify, Read & Execute, List Folder Contents, Read, and Write. Until what limit our web-site should be exposed so that it won't get hacked?

2.) How do most of them did when they allow user to upload files into their web-site, like geocities (photos), jobstreet(resume).

I did read the article from stardeveloper.com, but I can't get the answer I want.

[RainMaker]

I work with images and Databases alot and as far as the binary data vs. image folder gig I have found and thought that just saving the images in a folder heirarchy is alot manageable than just saving the binary data. I think this way is alot more dynamic than saving the data but maybe saving the binary is more secure and maybe faster but with today's technologies I don't think you will really notice a difference, as well as security.
I don't think that you should let people DIRECTLY upload anything to your site. I do belive in some type of mediary that would put the image there eventually but nothing like a copy paste. If you were to do a straight copy to your site/server then I would run a check agaist every file that would be like a script that would go and open the file check for picture headers to make sure that it is a picture....maybe even the extension, etc. I do not know how they other people did it but I can imagine that it wasn't anything direct. Those images were filtered somehow to ensure security. Although I don't think that those sites have a perfect record of keeping viruses out because of the upload process but it is a possibility that is works almost all the time. I hope that I helped just a little. I know how it can get lonely on here without anyone to get any feedback to you so I figured that I could give you a little bit of something.

[charonlee]

thanks you, anyway, i'm doing study on it.