Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I always gave to the webserver user full permissions on these dirs:


But now I am wondering if the uploads part is 0K. I was thinking that maybe it would be better if I use a .tmp file for each upload, and then put them in a queue to be moved to uploads/, and do the same for deletions (the queue will be read and validated by a different user). This way, even if an attacker gets to inject malicious code, the uploads/ folder will be safe.

share|improve this question
If your web server is configured properly, giving it permissions to write to the uploads directory should be fine. – nojak Aug 20 '12 at 17:27
up vote 1 down vote accepted

Your temporary file idea sounds like a fine idea to me.

Whatever directory the temporary files are uploaded to will need to be writable by the user that your code runs as (typically the webserver, especially when using mod_whatever).

Furthermore, this directory needs to be outside of the DocumentRoot. Whatever anyone uploads there should not be on the internet until it has been vetted. This keeps your server from being used in an email telling me that my logons have been disabled and I need to go to to fix it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.