title: What to do about storing user uploaded files in a Zend Framework application?
body: <p>I'm creating a web application that will involve habitual file uploading and retrieval (PDFs, Word Documents, etc).</p>
  
  <p>Here are the requirements:</p>
  
  <ul>
  <li>need to be able to link to them in my view script so a user can download the files.</li>
  <li>files should not be accessible to users who are not logged in.</li>
  </ul>
  
  <p><strong>Question #1: Where should I store these files?</strong></p>
  
  <ol>
  <li><p>On the file system?</p>
  
  <ul>
  <li>Does this mean an <code>uploads</code> directory in my <code>public</code> directory?</li>
  <li>I also want it to be easy for me to deploy a new version of my application when changes are made to the code. Currently I have a process where I upload my application in a directory titled with the current date (i.e. <code>2009-12-01</code>) and create a sym link to it titled <code>current</code>. This would mean that the <code>uploads</code> directory would need to be outside of this directory so it could be shared among all the different versions of the application, regardless of which one is being used at the time.</li>
  </ul></li>
  <li><p>In the database?</p>
  
  <ul>
  <li>I could store the file contents in the database and serve them up when a user requests to download them. This would keep the files in my application secure from non-authorized users, but I could achieve the same result once I create a controller to do this work.</li>
  <li>This would solve the issue of having to sym link.</li>
  <li>However, this might be bad practice (storing file contents in a database in addition to information).</li>
  </ul></li>
  </ol>
  
  <p>What do you think I should do?</p>
  
  <h2>Solution:</h2>
  
  <p>Here's what I ended up doing:</p>
  
  <p>I deploy a new version of my application, and create a symlink to the version I would like to use:</p>
  
  <pre><code>/server/myapp/releases/2009-12-15
  /server/myapp/current -&gt; /server/myapp/releases/2009-12-15
  </code></pre>
  
  <p>I created a directory above my application directory, and a symlink to that directory in my application:</p>
  
  <pre><code>/server/uploads
  /server/myapp/current/application/data/uploads -&gt; /server/uploads
  </code></pre>
  
  <p>I defined an <code>APPLICATION_UPLOADS_DIR</code> variable in my <code>/public/index.php</code> file:</p>
  
  <pre><code>// Define path to uploads directory
  defined('APPLICATION_UPLOADS_DIR')
      || define('APPLICATION_UPLOADS_DIR', realpath(dirname(__FILE__) . '/../data/uploads'));
  </code></pre>
  
  <p>And used this variable in my upload form to set the directory to upload to:</p>
  
  <pre><code>&lt;?php
  
  class Default_Form_UploadFile extends Zend_Form
  {
      public function init()
      {
          //excerpt
  
          $file = new Zend_Form_Element_File('file');
          $file-&gt;setLabel('File to upload:')
              -&gt;setRequired(true)
              -&gt;setDestination(APPLICATION_UPLOADS_DIR);
      }
  }
  </code></pre>
  
  <p>In my controller, I rename the file to something unique so it can't be overwritten by a file with the same name. I save the unique filename, original filename, and mime-type in the database so I can use it later:</p>
  
  <pre><code>public function uploadAction()
  {
      //...excerpt...form has already been validated
  
      $originalFilename = pathinfo($form-&gt;file-&gt;getFileName());
      $newFilename = 'file-' . uniqid() . '.' . $originalFilename['extension'];
      $form-&gt;file-&gt;addFilter('Rename', $newFilename);
  
      try {
          $form-&gt;file-&gt;receive();
          //upload complete!
  
          $file = new Default_Model_File();
          $file-&gt;setDisplayFilename($originalFilename['basename'])
              -&gt;setActualFilename($newFilename)
              -&gt;setMimeType($form-&gt;file-&gt;getMimeType())
              -&gt;setDescription($form-&gt;description-&gt;getValue());
          $file-&gt;save();
  
          return $this-&gt;_helper-&gt;FlashMessenger(array('success'=&gt;'The file has been uploaded.'));
  
      } catch (Exception $exception) {
          //error
      }
  }
  </code></pre>
  
  <p>To download the files, I created a download action which retrieves the file and sends it to the user with the help of <a href="http://www.noginn.com/2009/03/08/sending-files-with-the-zend-framework/" rel="nofollow noreferrer">Noginn's SendFile Action Helper</a>.</p>
  
  <pre><code>public function downloadAction()
  {
      //user already has permission to download the file
      $this-&gt;_helper-&gt;layout()-&gt;disableLayout(); //won't work if you don't do this
      $file = $this-&gt;_getFileFromRequest();
      $location = APPLICATION_UPLOADS_DIR . '/' . $file-&gt;getActualFilename();
      $mimeType = $file-&gt;getMimeType();
      $filename = $file-&gt;getDisplayFilename();
      $this-&gt;_helper-&gt;sendFile($location, $mimeType, array(
          'disposition' =&gt; 'attachment',
          'filename' =&gt; $filename
      ));
  }
  </code></pre>
  
  <p>To offer a download link in the view script, I point them to the download action with the file id param:</p>
  
  <pre><code>&lt;a href="&lt;?php echo $this-&gt;url(array(
      'controller'=&gt;'files',
      'action'=&gt;'download',
      'file'=&gt;$file-&gt;id)); ?&gt;"&gt;&lt;?php echo $file-&gt;displayFilename; ?&gt;&lt;/a&gt;
  </code></pre>
  
  <p>That's it! If you have any other advice or criticisms of this method, please post your answers/comments.</p>