I agree. It's usually not a good idea to store actual FILES in a database (PDFs, images, movies, whatever).
Instead, store the files in a secure data directory (i.e., not under your web root, if you want controlled access), then store the PATH in the database. When you need access, pull the path out of the DB, then fetch the file from that path, then stream it out to the client.