Question: I am creating a module of my website where I can display images in "albums", much like facebook.

For storing/grouping images, I planned on having them in the `~/Images` folder inside my application's structure. Is this considered bad practice, or will it open up my application to any security vulnerabilities? I read that you shouldn't place things like this in your site structure, but I don't quite understand why (or if this is the same scenario).

Therefore, albums would be grouped as...

`~/Images/album1`, `~/Images/album2`, etc.

Is this an appropriate thing to put inside `App_Data`, or is there a more 'preferred' location for things such as this?

Sorry if this is a trivial question.

Answer: 
Depending on the performance of your server, you may want to consider storing your images into a database using BLOB

<https://dev.mysql.com/doc/refman/5.0/en/blob.html>

Images can be easily sorted, organized, categorized without the need to worry about folder structures and folder permissions. Simply use your PHP/AJAX/language of your choice to provide the authentication and choose which files you wish to display.

This way, each image can have it's own fields (as many as you want) like the user who posted it, the original filename, a caption, the album it belongs in etc etc
I would use file system as you are saying but store it outside of the application folder as you are saying it is bad practice. I agree with this - when i do deployments I prefer to delete everything and drop in the new code and keep the web.config file that way I always have a clean environment and it is much easier to get started from scratch without having to worry about what I need to back up or bring from previous install.

I would use IIS to map the directory into my solution wherever I desire from a network share storage or whereever you want to safely keep your albums.

e.g. `D:\MySafeStorage\Albums\` map to your website's `~\Albums\` when your website is in `C:\inetpub\MyWebSite\`