I agree with your point of view as long as we are strictly speaking within a webserver environment. Webservers are of course optimised to serve files (of whatever nature) and the security-issues can be well managed there.

However, if you are just thinking of accessing the database directly (without going through a webserver first) I still think it is best to store the images in the database itself.

Of course the reference to cgi.pm in the original question should have tipped me of that this was a web-server related matter.

CountZero

"If you have four groups working on a compiler, you'll get a 4-pass compiler." - Conway's Law