upload image profile to writable or public

better put in public folder, the upload folder must have full access permission (on localhost). on live server, just need to change owner (CHOWN) to WWW-DATA.
writable folder cannot access directly on url since its outside the public folder ( just for read )