   [web] PHP & MySQL file upload best practices
  Hi there,I have been toying with PHP and MySQL for a couple of weeks now.I want to make a small web based site for our work intranet to share files with each other. (Just as a learning project, mainly :) )The plan is to have certain rights as to who has access to what files. Some of the files may be accessible to multiple people and not accessible to others etc.. You get the idea, I am sure.What is the best approach;1) Upload the files to the file system and keep a database of the name of the file and then encrypt the name for security purposes. And then play with directory permissions?or2) Upload the files as a BLOB directly to the MySQL database and keep track of who has access to what files in there, keeping the normal file system out of the equation.or 3) Something different???I think in terms of security option 2 would be better as people wont be able to stumble across the real files in the file system. But I have no idea if this is a bad idea in terms of performace and scalability. Just say theoretically a hundred users were using this system, how would it perform?What are your thoughts on this?Thanks in advance.    
  2) Blob.That's what I do anyway!  You can also implement versioning and checkout/in quite simply.   ;  Thanks for the reply.In my mind this certainly seems to be the more secure option and easier to manage (once the initial framework is written).Would this approach scale up ok (to a couple of hundred users), do you think?;Quote:Original post by lonewolffI want to make a small web based site for our work intranet to share files with each other. (Just as a learning project, mainly :) )You didin't mention how big the files are expected to be - that might affect the decision.Quote:1) Upload the files to the file system and keep a database of the name of the file and then encrypt the name for security purposes. And then play with directory permissions?You shouldn't need to play with directory permissions. Just require the user to be logged into the system to download files, and let the php/mysql handle access.   ;  Hi swiftcoder,I am thinking of having the files be 5Mb at maximum (possibly less). Would this be an unreasonable size to store in a database directly. I know this has the potential to significanty blow out DB size unnessesarily and is a definate down side. This is why I need to weigh up the pro's and con's.The reason I was thinking about directory access permissions is that I didn't want any old person to put in the full path of the file and download it without being logged in or having permission to do so.How would I avoid this if I went down the path of storing the files in a directory? If there is a way I can keep the files secure I would most likely use the directory as storage rather than store direct to a DB. In this event I would probably only use a reference to who has access to what in the DB.The last thing I want is for people to access files the dont have rights to. I would like to make things as secure as possible, behind the scenes.Any advice is appreciated.   ;Quote:Original post by lonewolffI am thinking of having the files be 5Mb at maximum (possibly less). Would this be an unreasonable size to store in a database directly. I know this has the potential to significanty blow out DB size unnessesarily and is a definate down side. This is why I need to weigh up the pro's and con's.Just store them as a file.Quote:The reason I was thinking about directory access permissions is that I didn't want any old person to put in the full path of the file and download it without being logged in or having permission to do so.You could of course always change the name and map it to the original name by using a database record, but that would be security through obscurity. Ideally, just store them outside the web directory where no browser client should have access to, kinda like this:..  /root/uploads   <- your uploaded file go here/websites   /mysite <- your httpd folder is here /images /css..(or they could even be on another server)Quote:How would I avoid this if I went down the path of storing the files in a directory? If there is a way I can keep the files secure I would most likely use the directory as storage rather than store direct to a DB. In this event I would probably only use a reference to who has access to what in the DB.In this setup, only the PHP user needs access to the folder. Just stream a requested file to a user by using a PHP script (make sure you set the correct page headers).   ;  Not bad. Good advice.  :)I'll give this a try, this seems like a great idea to me.;Quote:Original post by WanMasterQuote:Original post by lonewolffHow would I avoid this if I went down the path of storing the files in a directory? If there is a way I can keep the files secure I would most likely use the directory as storage rather than store direct to a DB. In this event I would probably only use a reference to who has access to what in the DB.In this setup, only the PHP user needs access to the folder. Just stream a requested file to a user by using a PHP script (make sure you set the correct page headers).Another method is to use some form of url rewriting (mod_rewrite on apache, for instance) to rewrite all requests to the file directory to a login check page. The page can then refer you to the original file if the stored login credentials check out, and otherwise redirect to a login page.   ;  I have tried WanMaster's advice and can get a file on to the server so it is out of scope from the public webpage files.Is there any examples around on how to 'stream' it back to the user as a complete file?The files that are being uploaded could be of any type if this makes a difference.Thanks again :)   ;Quote:Original post by lonewolffIs there any examples around on how to 'stream' it back to the user as a completeExample.