It's the best way because if they are outside of the webroot, then they are not accessible at all to the outside world. My attachments are in "/home/mysitename/attachments/" and my site is at "/home/mysitename/public_hmtl/" No one can get to my attachments except through vbulletin and using the vb permissions system. Just don't forget that when you store attachments/avatars/profiles in the file system, they will not be backed up when you do a database backup. You must back them up separately.
|