From php.net: http://www.php.net/manual/en/features.file-upload.php
<form enctype="multipart/form-data" action="_URL_" method="post">
<input type="hidden" name="MAX_FILE_SIZE" value="30000">
Send this file: <input name="userfile" type="file">
<input type="submit" value="Send File">
</form>
The URL should point to a PHP file. The MAX_FILE_SIZE hidden field must precede the file input field and its value is the maximum filesize accepted. The value is in bytes.
Then when you process the form, for added security, you can access the file size (once again, in bytes) using $_FILES['userfile']['size'] where userfile is the name of your file input. Then, run an if statement to make sure it's not bigger than what you want it to be.
Cgraz