Faster to use the filesystem, and more portable, too (most apps expect files, a database blob has to go through extra massaging before it starts to look enough like a file to be usable); slightly safer to use the database (but only slightly, and if you're paranoid about hotlinking, you could just move the images out of the web document tree).