Actually, seems this should take place during the upload.
Here's the upload code. Where should the str_replace be located?
if (@move_uploaded_file($_FILES['userfile']['tmp_name'][$i], realpath($home_directory.$path)."/".$_FILES['userfile']['name'][$i]))
and
print "<input type='hidden' name=path value=\"".htmlentities($path)."\">";