[eithan1231]

I was trying to avoid coming back to this thread, but I feel as if your response yields an opposite opinion.

The topics you cover are pretty ignorant of obvious security aspects. I can't speak to your personal experiences, but within my own experience, it would be awfully negligent to not protect user uploads. Static content or not, users and their uploads deserve to be protected. I'm not sure anyone made the claim that using PHP to serve a file would be more efficient than the web server, but you seem to be basing your argument solely for the purpose of efficiency. The good news is, you won't need to worry about the extra overhead of serving files when all of your user's uploads get leaked and they all abandon whatever project you're referencing.

Acknowledging that this thread is in the PHP Subforum, no one truly made the claim that PHP is the only backend solution. If you think PHP consumes too many resources, there's always C++/Java/Node/Python/Lua. I'm sure you can find the time to benchmark them and pick the best solution over PHP.

As a side note, just because Facebook and Discord don't have permission validation before serving files, doesn't really mean that there aren't legitimate reasons or applications to do so. Besides, taking into account Facebook's recent history in terms of their privacy and security, are they truly the best example for this?

i cbb explaining myself, but imma say we're both wrong and right. there are edge cases for both our points.

avatars (pictures publicly accessible) - should be handled by web server.
files/images sent between two people - should be permission checked.

they just two examples. it depends on what you're doing. there can be exceptions to both of the two things mentioned.

anyway, at the end of the day, who cares? I'm going to continue coding my way, you're going to continue coding your way.

[Strider64]

I personally don't allow user uploads of images to made available on my website until I personally vet it and that is even after I have checked it will php code when the user uploads the image. The only person I allow images to be seen immediately is me as I know I'm not going to upload anything malicious to my own website. I learned a long time ago when you start meddling around with security by writing your own code then it is trouble from the very start. Big companies have lot of people who code security for their websites and/or applications (or at least they should) and these people are professionals who alpha/beta test even before it is made public. An even then they sometimes get it wrong. I have learned the hard way never to give code when it it comes to security. I might suggest something and give an example of what I'm talking about, but even then I say use your the code at your own risk. Nothing is 100 percent secure on the internet, but pretending to be a security guru is only going to lead to more problems. Trust me been there, done that.

[Charger]

I personally don't allow user uploads of images to made available on my website until I personally vet it and that is even after I have checked it will php code when the user uploads the image. The only person I allow images to be seen immediately is me as I know I'm not going to upload anything malicious to my own website. I learned a long time ago when you start meddling around with security by writing your own code then it is trouble from the very start. Big companies have  lot of people who code security for their websites and/or applications (or at least they should) and these people are professionals who alpha/beta test even before it is made public. An even then they sometimes get it wrong. I have learned the hard way never to give code when it it comes to security. I might suggest something and give an example of what I'm talking about, but even then I say use your the code at your own risk. Nothing is 100 percent secure on the internet, but pretending to be a security guru is only going to lead to more problems. Trust me been there, done that.

Allowing your userid to have unfiltered uploads is a horrible idea.

Also, you can write very secure to prevent ALL non images from uploading and running. A competent coder could at least.

[TCP]

I personally don't allow user uploads of images to made available on my website until I personally vet it and that is even after I have checked it will php code when the user uploads the image. The only person I allow images to be seen immediately is me as I know I'm not going to upload anything malicious to my own website. I learned a long time ago when you start meddling around with security by writing your own code then it is trouble from the very start. Big companies have  lot of people who code security for their websites and/or applications (or at least they should) and these people are professionals who alpha/beta test even before it is made public. An even then they sometimes get it wrong. I have learned the hard way never to give code when it it comes to security. I might suggest something and give an example of what I'm talking about, but even then I say use your the code at your own risk. Nothing is 100 percent secure on the internet, but pretending to be a security guru is only going to lead to more problems. Trust me been there, done that.

What @Nachfolger said is enough to prevent any malicious upload, actually you don't even need to verify any user input indeed all you have to do is to save the file properly on your server and make sure it is always treated as an image so any block of unauthorized data is not executed.