0

Situation: Users upload documents through web form and the documents are stored in MySQL (InnoDB) as MEDIUMBLOB.

The rationality of this versus to store the original document on the webserver is the web form is only accessible to a small scale of users and the website admin does not want to have these documents stored on the webserver especially without confirming the content of these documents.

Condition: Currently limited to MySQL, HTML, JavaScript and PHP

Goal: Users click on a hyperlink/button which calls a function that will convert MySQL BLOB data type to the original document to make accessible for download or through the webpage for administration or users.

If there are better methods of storing these documents in the database or without storing on the webserver, I am open to new suggestions that would make this goal easier.

  • BLOB is limited to 64k which would limit it to pretty small files: What is the maximum length of data I can put in a BLOB column in MySQL?. You might want to consider MEDIUMBLOB or LONGBLOB instead. – Stephen Ostermiller May 3 '17 at 15:52
  • I'm not completely understanding the logic of "not storing them on the webserver" but allowing them in the DB. Is the thinking that they are somehow more secure in the DB? What is the worry about them in the filesystem? That more people have access to them there? It is harder to restrict access to them? That they are easier to accidentally click on and launch malware? – Stephen Ostermiller May 3 '17 at 15:55
  • @StephenOstermiller Thanks for the suggestion. I probably should of specified. The document size limitation is 1MB so they're stored in the DB as MEDIUMBLOB. – Mr. Tanaka May 3 '17 at 15:56
  • @StephenOstermiller I believe that is the logic. I came into this position with the data being stored in the database rather than the webserver. Also, avoiding malware and other potential threats is a major concern. – Mr. Tanaka May 3 '17 at 16:06
  • Also consider that storing files within the database is hugely inefficient and slow. The web server is the most efficient way to serve content. It seems like your admin is being a bit of an idiot. It has been my experience that when an admin pushes back on something that is normal business its because he does not want to be bothered and is more than a bit lazy. Cheers – closetnoc May 3 '17 at 16:11
0

Situation: Users upload documents through web form and the documents are stored in MySQL (InnoDB) as MEDIUMBLOB.... the website admin does not want to have these documents stored on the webserver especially without confirming the content of these documents.

Unless you have an unusual setup, a server would have the database system as well as the webserver software on the same computer, so chances are regardless how the incoming file data is processed, it will be stored on the server in general.

Goal: Users click on a hyperlink/button which calls a function that will convert MySQL BLOB data type to the original document to make accessible for download or through the webpage for administration or users.

The problem with your approach is that the database engine must run and handle your data, and your system needs to have enough memory or swap space to handle a large set of data. On top of that, that data needs to be identified in the database via a key of some sorts. What's worse is that the table can become extensively large if a lot of files are uploaded. Before trying this method, I'd recommend setting up a personal web server on your local computer with mysql installed and create a table with 1,000,000 or more records with a bunch of text per record, then try managing that table. You'll notice some functions take time such as sorting all the entries in the table.

There's a couple answers

If you're still OK with storing stuff on the server but the only real concern is to make certain content not accessible to the public then make a basic upload form, but make it so that after the upload is complete, the file is moved to any other accessible location on the computer outside of document root. (and outside of ftp root). That way, your server script as well as the user with root access to shell will be the only things that can access the uploaded files.

If you still want to keep files away from the "server", then I'm afraid you'll need to rent another server as well. One server can be just for files only while the other can be just for public-facing web pages. If you use this method, then you'll need to use some kind of program or protocol that allows your script running the web pages to communicate with the file server to manipulate the files. An FTP server on the file server and the script accessing that FTP from the web page server would work, but you might want a more secure option, but that's another topic in itself.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.