If they are uploading the image you could do it then...but it not...nope...
This is not entirely true. imagecreatefromjpeg() supports loading an image from a URL. That being said, you could perform a scale / resize on the image resource.
This is actually something i do a lot of so i'll tell you right now there are some possible drawbacks. Large images > 1 MB take a few seconds to render. If this is the route you decide to go, you should consider performing som caching as to only render the image once instead of every time it's viewed.
I actually think you should force the size using javascript...if the image is bigger than 400 px wide then set it to width='400' else do nothing...
This is definitely the easier of the two solutions; however, even if you calculate an aspect ratio the quality of the image will be poorer. It's no different than using width and height attributes in the HTML IMG tag.
If some quality may be sacrificed, which it probably can, go with JS.