Question: I am creating a module of my website where I can display images in "albums", much like facebook.

For storing/grouping images, I planned on having them in the `~/Images` folder inside my application's structure. Is this considered bad practice, or will it open up my application to any security vulnerabilities? I read that you shouldn't place things like this in your site structure, but I don't quite understand why (or if this is the same scenario).

Therefore, albums would be grouped as...

`~/Images/album1`, `~/Images/album2`, etc.

Is this an appropriate thing to put inside `App_Data`, or is there a more 'preferred' location for things such as this?

Sorry if this is a trivial question.

Answer: 
All three of the answers here are good. There is no preferred storage for uploaded images, it's all up to you based on your requirements.

As [Henhealg says](https://stackoverflow.com/a/11965147/304832), don't store them in App\_Data. If you put them here, they will not be accessible from the web. For example, the following would not render an image even if the path was correct:

```
<img src="/App_Data/album1/image1.png" alt="" />

```

One option is to have your local ~/Albums directory mapped to a different folder accessible to the web server, [like sylon says](https://stackoverflow.com/a/11965685/304832). This keeps the images out of the directory where your MVC app is served from, but "pretends" that they are there. If you control IIS and can set up a file share, this may be an option for you.

Also, [like XToro says](https://stackoverflow.com/a/11965624/304832), storing them in a SQL database is an option. Storing here is flexible because you don't have to worry about folder or file name collisions. Multiple users can each have albums and files with the same names, yet they won't collide because they don't occupy filesystem space the same way normal files do. If security is important to your app (not showing photos or albums to unauthorized users), having them in a SQL table makes this fairly easy. 

However if you are not as worried about security or file naming collisions, you can just as easily store them in your MVC app's ~/Images or ~/Albums directory.
Depending on the performance of your server, you may want to consider storing your images into a database using BLOB

<https://dev.mysql.com/doc/refman/5.0/en/blob.html>

Images can be easily sorted, organized, categorized without the need to worry about folder structures and folder permissions. Simply use your PHP/AJAX/language of your choice to provide the authentication and choose which files you wish to display.

This way, each image can have it's own fields (as many as you want) like the user who posted it, the original filename, a caption, the album it belongs in etc etc