Allowing User Uploads of Images... Securely

[PDX_Doug]

Good morning everybody,

 

First off, I will state openly and freely that I am a total newbie at PHP and MySQL coding. I'm reading lots of books, following every forum I can find and taking classes, but the bottom line is I'm very green behind the ears!

 

I am currently in the process of building a website that will - among other things -allow members to upload images. I have seen in a number of sources that this can be a dangerous thing, and requires careful security planning and coding. I think I pretty much get the basics of validating other data (text, dates, etc.), but am really at a loss on how to deal with images.

 

Can anybody offer any information about what I need to be doing (and better how to do it!)? I'm not asking for anyone to write my code for me, but to point me in the right direction.

 

I have also heard that it is not a good idea to store the images in the database table that contains other data related to the upload. That it is better for the table to contain a link to the image stored which is stored in another directory. Is this the correct way of going about things?

 

Thank you in advance for any help you can give. As I said, I'm a newbie now... but I'm trying!

 

Thanks,

Doug