BLOB 比允许对 Web 服务器上的目录进行写权限更安全
我正在构建一个系统，允许输入数据库（如果需要，请考虑用户帐户）以具有与其关联的图像。这些都是小图像，而且数量不会很多。
我知道使用 BLOB 的一般优点/缺点，并且在这种情况下似乎不会成为问题。不过，这个项目的安全性很重要。那么，在我的 Windows 服务器上设置一个目录来存储用户上传的图像，而不是仅仅将图像作为 BLOB 粘贴到数据库中，是否更安全？
那么，网络用户将图像加载到服务器的潜在安全问题是否足以造成轻微的性能影响，或者我是否过于谨慎？
该网站是用 ASP.NET 4.0 构建的，数据库是 Sql Server 2008，我用来托管该网站的服务器可以是 Windows Server 2003 或 2008。
I am building a system that allows for an entry into the database (think user accounts if you want) to have an image associated with it. These will be small images and there won't be many of them.
I know the general pros/cons of using a BLOB and it doesn't seem like it will be a problem in this case. Security on this project is important though. So is it more secure to set up a directory on my Windows server where the site can store images uploaded by a user instead of just sticking the image in the DB as a BLOB?
So are potential security concerns over web users loading an image to the server significant enough to take a small performance hit or am I being over cautious?
The site is built in ASP.NET 4.0 and the database is Sql Server 2008, the server I am using to host the site could be Windows Server 2003 or 2008.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
是的，在 SQL 数据库中使用 blob 来存储敏感信息是非常安全的。
1）彻底消除目录遍历问题。
2）轻松地逐个文件地应用访问控制并将其链接到用户/组。
3）数据库内置加密。
或者，一种安全且更快的方法是将文件存储在 Web 根目录之外。将文件名更改为主键，并将元数据（例如访问控制）存储在数据库中。当您提供文件时，asp.net 可以根据文件名查找主键并打开磁盘驱动器上的文件。
Yes using blobs in a sql database to store sensitive information is very safe.
1)Completely eliminates the problem of directory traversal.
2)Easy to apply access control on a file by file basis and link this to users/groups.
3)The database has built in encryption.
Alternatively a safe and faster approach is to store the files outside of the web root. Change the file name to the primary key and store the metadata (such as access control) in the database. When you serve the file the asp.net can look the primary key based on the file name and open the file on the disk drive.
是的，它更安全。如果您使用 PHP，我可以提供一个具体的例子来说明原因。可以说，用户可能能够利用代码/系统中的漏洞，使他们能够执行看似图像中包含的代码。
编辑：当然，你必须防止 SQL 注入，但通常很清楚你是否做对了。
Yes it is more secure. If you were using PHP I could provide a concrete example of why. Suffice it to say that the user may be able to exploit a hole in your code/system that would allow them to execute code contained in what appeared to be an image.
edit: Of course you have to protect against SQL injection but it's usually clear whether you did this right or not.