Can files be stored above webroot, like attachments?

1. I'm assuming the photos/images are stored as files on the webserver, not put into the database, is that correct?

2. If #1 is correct, is it possible to store them in a directory above the webroot, just like attachment files can be (if they're stored as files outside of the database), so they can't be linked to directly?

i believe in the new version that will be possible.

o and 1 is correct

[PhoenixDown21]

You can htaccess the img folder to stop direct hot linking and the best part is, all you need to do is click a button and the gallery will set up the htaccess for you.

If that's true, then why does vBulletin recommend putting the attachments folder above the webroot?