Databases can store what are known as BLOB's, Binary Large Objects. However if you want to store a lot of these BLOB's, I would be thinking about storing the user metadata in a database and having a "pointer(s)", which could be filepath(s)) to the BLOB object(s) which are stored as file(s) under the file system.

You probably do NOT want each of your users to have an account on your server machine, therefore the OS cannot provide any security for file access. Your application will have to do that.

One user might have 500MB of BLOB's, but only his meta-data is stored in the actual DB. There are of course significant complications with this. Think about the question in terms of what you are trying to do (how many users, how much total data, how much data per user, etc) and re-post a more detailed question that relates to your specific job at hand.