Use the input field of type 'file'. You don't get a lot of stylistic or other control over this thangy, but it works and enforces the sandbox concept. Example:
<!-- MAX_FILE_SIZE must precede the file input field -->
<input type="hidden" name="MAX_FILE_SIZE" value="20000" />
<!-- Name of input element determines name in $_FILES array -->
Avatar file: <input id="avatar" name="avatar" type="file" value=""/>