Question

I have a topic/question concerning your upload filename standards, if any, that you are using. Imagine you have an application that allows many types of documents to be uploaded to your server and placed into a directory. Perhaps the same document could even be uploaded twice. Usually, you have to make some kind of unique filename adjustment when saving the document. Assume it is saved in a directory, not saved directly into a database. Of course, the Meta Data would probably need to be saved into the database. Perhaps the typical PHP upload methods could be the application used; simple enough to do.

Possible Filenaming Standard:

1.) Append the document filename with a unique id: image.png changed to image_20110924_ahd74vdjd3.png

2.) Perhaps use a UUID/GUID and store the actual file type (meta) in a database: 2dea72e0-a341-11e0-bdc3-721d3cd780fb

3.) Perhaps a combination: image_2dea72e0-a341-11e0-bdc3-721d3cd780fb.png

Can you recommend a good standard approach?
Thanks, Jeff

Answer 1

I always just hash the file using md5() or sha1() and use that as a filename.

E.g.

3059e384f1edbacc3a66e35d8a4b88e5.ext

And I would save the original filename in the database may I ever need it.

This will make the filename unique AND it makes sure you don’t have the same file multiple times on your server (since they would have the same hash).

EDIT

As you can see I had some discussion with zerkms about my solution and he raised some valid points.

I would always serve the file through PHP instead of letting user download them directly.

This has some advantages:

1. I would add records into the database if users upload a file. This would contain the user who uploaded the file, the original filename and tha hash of the file.
2. If a user wants to delete a file you just delete the record of the user with that file.
3. If no more users has the file after delete you can delete the file itself (or keep it anyway).
4. You should not keep the files somewhere in the document root, but rather somewhere else where it isn’t accessible by the public and serve the file using PHP to the user.

A disadvantage as zerkms has pointed out is that serving files through PHP is more resource consuming, although I find the advantages to be worth the extra resources.

Another thing zerkms has pointed out is that the extension isn’t really needed when saving the file as hash (since it already is in the database), but I always like to know what kind of files are in the directory by simply doing a ls -la for example. However again it isn’t really necessarily.