We have forms where we get clients to upload images of very sensitive information (passport, signature, etc.). We will store their written information into a database. However, there is the issue of the images. Usually, I hear people saving the images in a filesystem and having a link to it in its cell as a reference. I know I can also save the entire image as a blob in the database.

My question is on the matter of which would be more secure; both from the outside and the inside. This isn't an issue of users uploading malicious files, but more about where would I hide them better?

  • 1
    None. Anyone who want to protect their file should just encrypt the file and keep thee encryption private key somewhere.
    – mootmoot
    Feb 26, 2019 at 10:48
  • 1
    what about encrypting the blob in the db, and decrypting it on demand ? Feb 26, 2019 at 13:41

1 Answer 1


The difference is not too big from a security perspective. If your database is breached, the attacker will either have the actual data or working access to it. If the files were to be properly stored externally, in the case of an attack as a direct quick response you could deny access to them (by means like dismounting the location they are stored on) but this is a special case.

From a data perspective, keeping a lot of large files in databases is not good and not recommended. Databases were not designed for file storage.

So my vote goes to links in DB and separate files.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .