Attachments not in DB

[tubedogg]

There are some disadvantages to this.

First, if you allow html, php, or other code files (js, asp, etc.), and they weren't stored in the database, they could be executed on your server by clicking the attachment link. This could be devastating if someone knew what they were doing.

Well I guess that's really the only disadvantage I can think of (I thought there were others...) but that's a pretty major one in my book.