what is this directory? file uploads should not go into the web/ folder, that is very dangerous for injection attacks. (if i manage to upload a php file, i can call it in a browser and pretty much own the server...) or am i misinterpreting the name?