by the way - i have done a upload script for users to upload their avatars into a server folder, images named by the user_id.
but i don't think it's taht secure yet
perhaps somebody could work out a "perfect" avatar-upload script include for the profile page?!