Uploading File Concerns

I am trying to add functionality to a Message Posting ASP Page that will allow users to add attachments to their messages. Currently everything works except for adding the attachments.

Like I said, this is an ASP Page with a MySQL backend. The form has a INPUT TYPE=�File� to allow the user to select the file using the familiar Windows dialog boxes. Here is where I am stumped now.

Do I add the attachment to the MySQL database or do I copy the file up and place it in an Attachments folder on the web server? This way I could then add a field to the MySQL database with the location on the server to later retrieve the attachment.

Then, are there any other elements that I need to think about? Should I encrypt the file before placing it on the web server? Since I am so new to this, what kind of security concerns should I be thinking about?

Lastly, if I do upload the file�the research I have done so far pointed my to use the Server.CreateObject, then do a .Save. Is this the best and safest way to upload a file?