Best Practice for Saving Images

Question

I am allowing users of the admin panel of my website to upload photos, its a simple process where I check the validity of the image and then save it to a folder, then I also have to record a couple of database records for that image to be able to retrieve it later, my saving function is as follows... The function that uploads and saves the picture in the folder with a name i construct in another function:

My_HTMLInputFile.PostedFile.SaveAs(HttpContext.Current.Server.MapPath("~/photos\" & pta.FileName))

And the function that creates the database record for that same picture:

Public Function InsertPhoto() As Integer
        Dim pta As New GKPTableAdapters.tblPhotosTableAdapter
        Return pta.InsertPhoto(PhotoCaption, PhotoDescription, ("http://www.myURL.com/photos/" & FileName), IsDefault, IsPicture)
    End Function

Now I know that what I am doing is full of best-practices violations, so please point me out to what I should do, keep in mind that the users might delete the pictures later, so I wanna make sure that I can delete the database and file of the picture, and the whole issue of the path is confusing me :P

Thanks in advance.

Answer 1

Something I've noticed right off the bet is that you are hardcoding the FULL PATH to the image.

I'd just store the image name, and then prepend the relative path when i display it in the application

If you allow your users to delete the files via your application, you should delete the record in the database, and then delete the file itself by using File.Delete method

Answer 2

You may also want to look at your file name generation. If you use an md5 hash of the image data as the file name, for example, you can prevent people from uploading duplicate images and you also don't have to think of a way to generate "unique" names for the images.

Exposing your photos directory directly to the internet may be a bad idea if there are images in there that the public should not see and your naming policy is predictable. People will start guessing image URLs and stumble upon something they are not allowed to see.