>I think you're more secure in the virtual folder than opening up a folder elsewhere.

The Virtual Folder can point to a folder elsewhere on the network. It will appear to the application to be in the Applications own folder structure, but IIS will store content whereever you specify (assuming the permissions are correct). We do this for most of our sites.

>
>>We have an ASP.NET application that requires uploading and storing of files. A developer here wants to place the upload attachment folder within the application physical folder structure associated with the virtual directories.
>>
>>I do not want to place it there due to the possibility of security issues. Are there accepted practices for the placement of application file upload folders? Is this documented anywhere?
>>
>>Thanks,
>>Bill