The UID should be in the current users session. Don't pass it via AJAX.

Eg: When you logged the user in, create a session for the user. You can use the built in PHP session management $_SESSION. Or you can create your own session management by entering each login into a session table in the database.

When a user uploads something, check a cookie sent by the user for the session ID. You can verify this session exists by looking up your session db table, or $_SESSION variable if you use that...