I'm working on an application that makes use of the Symantec Protection Engine to scan uploaded files. I'm having issues with my files after they have been scanned. One possible solution I've seen is to store the uploaded file in a temporary folder, then stream it to the protection engine. If the engine determines the file is clean, I would then access the file from the temporary folder and pass it on to it's final home. If the file is dirty, delete the temporary folder and let the user know what the problem is.
So the question is, would storing the possibly infected files in a temporary folder open the system up to infections?