Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We upload users avatar with their primary key name. avatars name are 1.jpg,2.jpg,3.jpg,... according to their primary key.
We implemented this to omit avatar field from database, instead with use their primary key to access their photos.
Is it vulnerable or I'm just too sensitive about it?

share|improve this question

Assuming (a) primary key isn't a secret in any way and (b) primary key is limited to filename-safe characters (which looks to be the case here as it's numeric), yeah, that's fine.

Naturally there are other security concerns with the content of user-uploaded images as outlined in previous questions.

The only other potential gotcha I can think of if you're moving this from a database BLOB implementation is that the database may be transaction-safe but the filesystem won't be. But as long as your application doesn't fall over when there's an avatar file missing that shouldn't be an issue.

share|improve this answer
My app does not fall over. I took good care of that. tnx @bobince – Alireza Hos Dec 27 '11 at 13:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.