"2) When you submit the script, the CGI attempts a SOCK_STREAM connection to your computer, on a port that only YOU knows and asks for the file if it finds somebody listenning. The CGI knows your IP, provided that your are not behind a silly firewall, with $ENV{REMOTE_ADDR}."
If I am understanding you correctly, you are going to put FTP on another port besides 21 for security easons? That sounds security throiugh obscurity to me. Just my 2 cents.