how to be secure with file uploads...

[eluser]tomdelonge[/eluser]
So, the administrator of the website will upload an image associated with a product. Where should those images go? Just in an images folder, right below the webroot, I'd guess.

One thing I don't understand at all is folder permissions. How do I make it so no one can mess with the folder, but I can upload to it?

Some suggestions?