add warning about placing input/output files outside web root