I would like to add one more observation. A lot of people think that the best place to upload files is into a subdirectory in a WAR.
It is not. For one thing, in strict
J2EE usage, a WAR is a single (ZIP-format) file and as such
has no subdirectories in the literal filesystem sense. You'd have to create a whole new WAR containing the uploaded data, since the Java ZIP classes don't allow update-in-place for ZIP files and their relatives.
However, a lot of webservers "explode" WARs into real files and directories. You might think then that as long as you're using such as server, you're OK.
Wrong. The first time you update the webapp, that WAR is going to get nuked and so will all of the uploaded file data.
Always upload your files to some directory that is external to both your webapp server and your webapp. For Linux/Unix systems, the convention is usually to put that directory under the OS /var/lib directory. Windows has no such convention, so it's up to you. All that really matters is that the data will be stored out of harm's way. Extra points for putting it some place that gets backed up, though.