I think it is inadvisable to have the database point to a file in the filesystem

I understand what you're saying here (someone can change a file to be something you dont want it to be) regardless of the optimisations in a modern RDBMS it is generally considered a more scalable solution to put the images on the disk and a pointer in the db.

Of course if you've a low volume site that is lite on graphics, it may well be better to keep your graphics in a DB.

Unfort, i dont have any metrics handy to backup my claims here..:-(

I agree with your point of view as long as we are strictly speaking within a webserver environment. Webservers are of course optimised to serve files (of whatever nature) and the security-issues can be well managed there.

However, if you are just thinking of accessing the database directly (without going through a webserver first) I still think it is best to store the images in the database itself.

Of course the reference to cgi.pm in the original question should have tipped me of that this was a web-server related matter.

CountZero

"If you have four groups working on a compiler, you'll get a 4-pass compiler." - Conway's Law