Safe way to support hosting files from asp.net mvc site

i have an asp.net-mvc site where users can add content and links and the data gets saved in a database. They now want the ability to upload attachments to pages and i wanted to figure out a fe开发者_如何转开发w things:

1. I have upload code that will upload files (pdfs, images, etc) but i wanted to see where i should be storing them. should i store them outside the website directory structure ?

2. Is there any file types that i should be concerned with storing. I would basically have a file picker on the front end.

I have upload code that will upload files (pdfs, images, etc) but i wanted to see where i should be storing them. should i store them outside the website directory structure ?

Not necessary. You could use the App_Data special folder and store the path to the file in the database along with an unique identifier so that you could retrieve it later. Files inside this folder are not served by the web server and are not directly accessible. Another approach is to store the files into the database. SQL Server 2008's new FILESTREAM type is very useful.

Is there any file types that i should be concerned with storing. I would basically have a file picker on the front end.

Not really. Executables could be dangerous as might contain viruses but as long as you are only storing them and never executing you should be safe.