I'm always tempted to do these types of things in a database somehow. It allows me to easily/quickly determine who uploaded what and when (and have a cron job delete anything that is marked temporary and older than X hours). It does mean that the image retrieval has to be a CGI script - but it also allows the images to be moved around as long as I can point my database client to the server properly.

Once I have such a cron job cleaning up the temporary files, I probably wouldn't bother worrying about abandoned files anymore. Just leave them, and the cron job will (eventually) clean it up. If you have a reasonable limit on image size, there really shouldn't be very many temporary images sitting around anyway. Note that you can use the filesystem to do the same thing - I just like the SQL syntax for it better as I can attach a lot more metadata to the image in SQL than I can in the file system.

Note that I don't see abandoned files as a "security risk". I see that just as a cost of doing business in the stateless world of CGI. Which is where the cron job comes in. What I do see, however, is the distinct possibility that two people upload the same filename, resulting in a collision. By giving each file a generated identifier in the database, you can then refer to each image by that identifier instead of the original name, and not need to worry about collisions. Using the filesystem, you need to find another way to prevent collisions without race conditions.

In reply to Re: Preview uploaded image by Tanktalus
in thread Preview uploaded image by tanger

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.