In what directory to put uploaded image files?

[alexks]

Where to put uploaded files? Should it be /photos directory with thousand of files or /userId/photos for eash user. In the last case the userid must be retrived from database to create path to the image with the image name. Is this secure?

Thanks.
A.

[sneakyimp]

There are a couple of irritating things about having thousands of files in a single folder.
1) If you try to list the contents of the folder using dreamweaver or an FTP client or something it can be slow and the huge result listing can be a pain.
2) What happens when two different users both have a file named "me.jpg". You have to be careful to avoid name collisions.

The many directory approach helps with both of those problems. But then you may have the issue of having thousands of user directories.

Whether or not the /userId/photos approach is secure will depend on what your code looks like. You should NOT take the value of 'userId' directly from user input without first checking it or validating it to make sure it is safe. Someone could put in something like "../../passwd" or something and overwrite your password file.

If you are pulling an ID out of your database for the value of userId then you should make sure that whatever goes into the database is OK. If you can be absolutely sure that userId is an integer, then it sounds really safe to me.

[alexks]

The userId will be the id of user table which is primary key and auto incremented. My only concern is that by looking to source in the browser one can get id of a user who uploaded current photo. Is it secure if hacker knows, id of a user in user table? Another question is that, what is the best way to handle uploaded files? Let say how myspace.com or youtube.com handle uploaded files?

Thanks.
A.

[sneakyimp]

It's impossible to say whether showing a userId is insecure unless you consider all of your code. IMHO there is no risk at all if your db-handling code is properly written. On the other hand, I remember MySpace having a problem where someone found out how to download everybody's private photos which could be related to the use of auto-incremented IDs coupled with the photos being in the publicly readable document root. What you are asking is basically just too general to comment on.

I don't think anybody but myspace or youtube know how they handle file uploads. They also have thousands of servers to support all the traffic they deal with.