Honestly have you tested this? I've done countless upload scripts and the only thing the browser is supposed to send is the filename itself, so if you have

 
C:\Windows\My Documents\foo.jpg
[download]

The browser should only send back 'foo.jpg'. Now of course there are exceptions, namely that evil browser made in Redmond IE 5 I believe sends the entire thing, but the '\' marks get sent with it. I get around that by doing this:

my $filename = $cgi->param('uploadedfile');
if($filename =~ /\\/) {
     my @tmp = split(/\\/,$filename);
     $filename = pop(@tmp);
}
[download]

In your case you could probably run that bit of code in a loop to fix all your filenames, should they have that problem.

Lobster Aliens Are attacking the world!