title: CMS upload picture files security issue
body: <p>I have a quick question if anyone could help.  I am building a CMS for a client where they can log in, and change content (including pictures via upload file form) that are all stored in a database.  </p>
  
  <p>My question.. I have been researching, and everywhere says I need to store the image files outside the root folder.  Is this necessary in my case if only a few people will be uploading files, inside an admin panel, where they must first log in to the site?  I will have already taken steps client side by making sure of file type, size, extension etc... then changing the name of the file before adding it to my DB... Is this secure enough, or am I asking for trouble down the road?</p>
  
  <p>Thanks</p>