title: Where is better to store uploaded files in DB as BLOB or in folder with restrictions?
body: <p>I'm working with the <code>FileUpload</code> in my project. And  this project would be high visited (it's not my ambitions, just because web application does work with a payment system, that's why it will be under high-load). And I wonder, what's better for a storing the user's files? My project is based on <strong>ASP.NET</strong>.</p>
  
  <p>I suggest two variants:</p>
  
  <ul>
  <li>save as/load a <strong>BLOB</strong> object into/from database</li>
  <li>save/load to/from a <strong>folder</strong> where the files will locate and save info about files in the table for owner recognizing, the table design in <strong>BNF</strong>:</li>
  </ul>
  
  <p><code>&lt;user_files&gt; ::= ( &lt;id ::= int, primary_key, auto_increment, indexed&gt;&lt;user_id ::= int&gt;&lt;file_guid ::= varchar(255)&gt;) | nil</code></p>
  
  <p>I prefer <strong>BLOB</strong> , but afraid of a future high-load. Because, fetching data from the database requires more CPU-time and memory allocations, because:</p>
  
  <ul>
  <li>I need to use a connector, which will open a new socket to connect to DB localhost</li>
  <li>Then must call stored-procedure for a getting BLOB object</li>
  <li>at client-side, I must get the result from some classes from the connector</li>
  <li>I must deserialize it</li>
  <li>and only then just to send the file to a user in uncompressed and not corrupted state, so user can later open it in some editor (files often would be images and ms-office documents)</li>
  </ul>
  
  <p>As I thought all these operations may decrease the server work and will require more time, I think it would be slow for a 2000 users online, which will exchange the documents very quickly</p>
  
  <p>As for the storing files on the filesystem, I see only problem in:</p>
  
  <ul>
  <li>securing correctly the access of files, because different users <strong>must not</strong> see others docs and they must be <strong>hidden</strong> for the other users. I'm afraid, because the folder to which users are uploading files is seen for the system user of Windows for the IIS (IISUser...), because otherwise users won't be able to upload anything, so the folder will be public. I see only solution to make a Windows Service and to use IIS folder for the uploads as temporary. Windows Service will get files from it and place to the secure folder, where users from web would be unable to see it.</li>
  </ul>
  
  <p>But, maybe, I'm going wrong with my ideas, that's why I'm asking you a piece of advice, because I want to make system more perfectly.</p>
  
  <p>Thank you!</p>