Storing files/attachments

[Daniel0]

This is something I have been thinking about.

Which would be the best option to store files (such as attachments)?

[b]Option 1:[/b]
Have a database table called something like attachments where you store the mime-type, path of the file on the disk and other things about the file. The file is stored in a folder specified by a configuration file with a random filename generated like: [code]uniqid(md5(microtime()));[/code]

[b]Option 2:[/b]
Same as for the database option 1, except that there will be one more field called data, which is where the contents of the file is stored in.

[redbullmarky]

most definitely the first one. i used to actually use the second approach quite a bit, but its only a matter of time before things start grinding and problems crop up.
it also makes it easier to access your files directly should you need to, without extracting them from your database with a script first.

[Jenk]

Just increment a number, there's no need to go to any length to generate a random filename.

[Daniel0]

[quote author=redbullmarky link=topic=109962.msg443741#msg443741 date=1159542921]
it also makes it easier to access your files directly should you need to, without extracting them from your database with a script first.
[/quote]

The point is that they would [i]not[/i] be accessed directly.

[redbullmarky]

[quote author=Daniel0 link=topic=109962.msg443808#msg443808 date=1159550014]
The point is that they would [i]not[/i] be accessed directly.
[/quote]
ok cool. makes no difference to my answer though - definitely better to store a link rather than the file itself.

[Jenk]

You can store flatfiles without needing direct access. Just put them in a directory that is above the document root.

[neylitalo]

[quote author=Jenk link=topic=109962.msg443861#msg443861 date=1159554047]
You can store flatfiles without needing direct access. Just put them in a directory that is above the document root.
[/quote]

Just be aware that with this process, it is very easy to accidentally allow unregulated access to those files. If this route is taken, and you need to control who accesses the files and/or when they're accessed, or anything else, just make sure that you don't allow the clients to directly browse to those files.

[Daniel0]

It would be something like this: download?id=16 then it could check it the user has permissions to download the file.

I'm not really going to make a script that does this, I just wondered what would be the best option. I would actually choose option 1, but I wondered if option 2 was better since databases are designed to handle data.