Unfortunately, you've gotten all the ideas and suggestions you're likely to get. This is what it boils down to:
1) HTTP is a connection-less, unidirectional protocol. Is is not designed for file uploading.
2) HTTP can do file uploads through the <file> form element. This is a one to one relationship. One file can be uploaded for every occurance of the <file element. There's no way around this fact of life using any existing technology; this includes PHP, ASP, C, Java, JavaScript, JSP, ColdFusion, CGI, etc. Accept it.
3) There's a reason why FTP is named File Transfer Protcol. A hammer can pound in a screw, but it's much more efficient and sensible to use a screw driver. It's the same thing with what you're talking about.
4) There is, can only ever be, one user account that the webserver is running as. That is the only account that that can copy files around the server's filesystem. The webserver user account becomes the default owner of any files uploaded though a form. If the copied file(s) need to be owned by another account, you have to change the permissions once the copying is complete.
If you're so insistent of using a browser-based interface exclusively, your only real option is to write a browser-based FTP client.
You will still need an FTP server running and all your customers are still going to need FTP accounts to be able to upload. Thus, it makes more sense just to give them normal FTP access.
If you're worried about about potentially harzardous files being uploaded, make sure IUSER_* doesn't have execute permissions and configure your FTP server to refuse files of the given extension.
If you're still worried, tell your customers that filetypes X,Y,Z are not allowed and will be deleted. Then write a script which trolls though your user folders on a regular basis deleting all the banned file types based on their mime-type (not the extension.... to easy to fake).
-geoff
