Question

I’m using php and MYSQL. I’ve created a members area where people can upload important images (basically for financial record). I was hoping to get some advice as to the best way to store these files. What kind of folder structure would be best? Ex domain.com/Files/UserName/RandomGeneratedName/Files.

Also any advice for chmod, .htaccess, .htpassword and any kind of password protection with php.

Thanks in advance.

Answer 1

I would recommend to store them outside the tree. In this way, by default you need to enable access to them, not disable access (just in case you have a bug in your .htaccess/config/code, the access to the files is disabled, not enabled)

Second, get rid of the random directory, it doesn’t add much to the security, but it complicates the implementation unnecessarily

You can use php to check the member credentials, put the appropriate headers (mime type for ex., etag, etc.), and serve the file via passthru or something similar.