A small company without any IT skills wants to run a web application where customers can enter various bits of data and upload pdfs.The documents regard product specifications and have to be kept secure.They have one external IT guy who wants to sell them a PHP application for the task. He wants to store the documents directly on the webserver, and sync them with Google Drive, which they use for their internal documents.Is it ok to store the documents on the server, or does this create a potential security problem?I have the feeling that they should not keep the files on the server after uploading, and that they should get them away from the webserver and into a more protected domain right after the upload has taken place?Is it okay to sync these sensitive files with a Google apps for business account? The Google credentials must be known to the webapplication. Does this pose another security risk?Would you advise against the use of PHP in this scenario?Is there a better solution to this?Thanks a lot! :-)
How to store uploaded client documents securely in webapplication
architecture;web applications;security;upload
First off, you shouldn't be thinking of security in terms of a binary 'ok' or 'not ok'.  Every choice you make has security implications that you want to understand.  Regarding keeping the files on the web server's machine, that's not typically a problem for most commercial applications.  You just need to make sure they aren't accessible via the web server. Storing them outside the the web server's document directories is a typical strategy.  And of course, don't neglect security on the server itself.Putting the files into a Google Drive folder should be fine. Another option is to periodically rsync down to the local network.  But it really depends on what the company needs.  Another option is to provide the company a web based system by which the files are accessed, and do away with the file replication all together.PHP is fine.  Rarely is the language choice a major factor. You are far, far more likely to encounter security issues in the application code itself.  Just keep PHP up to date.  But that same is true for every server-side language.