Should I save uploaded(img files) to App_Data?

Question

I am using asp.net mvc and have a section where a user can upload images. I am wondering where should I store them.

I was following this tutorial and he seems to store it in the app_data. I however read another person say it should only hold your database.

So not sure what the advantages are for using app_data. I am on a shared hosting so I don't know if that makes a difference.

Edit

I am planning to store the path to the images in the database. I will be then using them in a image tag and rendering them to the user when they come to my site. I have a file uploader that only will expect images(check will be client and server)

Answer 1

The tutorial is a simple example - and if you read the comments, the original code just saved to an uploads directory, no app_data in sight.

It was changed to app_data because that's a special folder - one that will not allow execution of code.

And you have understood correctly - app_data is really there for holding file based databases. That's the meaning of the folder. As such saving images into it doesn't feel like the right thing to do.

If you are certain only images will get uploaded (and you control that), I would suggest an /uploads directory - a reserved location for images that also will not allow code execution (something that you should be able to control via IIS).

Answer 2

I would say that depends on what you will do with that images later. If you use those images in an img tag, you could save them somewhere in the Content/ folder structure.

If you do not need them reachable from the outside, or need to stream them changed back, you might store them out of the web root if the hoster allows for that.

I wouldn't store them in app_data, as I - personally - think that it's more a convention to store there a database. Most developers not familiar with that product wouldn't look there for the image.

But: you could store binaries in a db (even though it is probably not the best thing to do), so a reference in a db pointing to a file in the same directory makes sense again.

It's more an opinion thing than a technical question though, I think.