PHP create folder, upload file and allow delete file best security measure
<p>I am developing an application that allows users to upload images. The script creates multiple sizes of the image and stores them in folders with a session ID e.g. /uploads/skj28cnkjck783wo/thumbnails before renaming the folder to a unique name once the user hits submit/next/go.</p>

<p>I need to allow users to have the ability to remove individual files but wondering what the best secure way of doing this would be. If I base the delete off the session ID surely users would be able to change this and remove files that don't belong to them.</p>

<p>I was thinking I could store user information and the object reference in a table and do a lookup to ensure that user has access to remove that file or store the files in a folder with the user ID which is unique based on DB entry but wondering what the experts think. I have done some Google searching but all have flaws.</p>

<p>I am running IIS7 as the web server.</p>

<p>Thanks</p>
