上传：
需要导入两个包：commons-fileupload-1.2.1.jar,commons-io-1.4.jar
import java.io.File;
import java.io.IOException;
import java.util.List;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.fileupload.FileItem;
import org.apache.commons.fileupload.disk.DiskFileItemFactory;
import org.apache.commons.fileupload.servlet.ServletFileUpload;

/**
 * 上传附件
 * @author new
 *
 */
public class UploadAnnexServlet extends HttpServlet {

 private static String path = "";

 public void doGet(HttpServletRequest request, HttpServletResponse response)
   throws ServletException, IOException {

  doPost(request, response);
 }

 /*
  * post处理
  * (non-Javadoc)
  * @see javax.servlet.http.HttpServlet#doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
  */
 public void doPost(HttpServletRequest request, HttpServletResponse response)
   throws ServletException, IOException {

  path = this.getServletContext().getRealPath("/upload");

  try {
   DiskFileItemFactory factory = new DiskFileItemFactory();
   ServletFileUpload up = new ServletFileUpload(factory);
   List<FileItem> ls = up.parseRequest(request);

   for (FileItem fileItem : ls) {
    if (fileItem.isFormField()) {
     String FieldName = fileItem.getFieldName();
     //getName()返回的是文件名字 普通域没有文件 返回NULL
     //                    String Name = fileItem.getName();
     String Content = fileItem.getString("gbk");
     request.setAttribute(FieldName, Content);
    } else {
    
     String nm = fileItem.getName().substring(
       fileItem.getName().lastIndexOf("\\") + 1);
     File mkr = new File(path, nm);
     if (mkr.createNewFile()) {
      fileItem.write(mkr);//非常方便的方法
     }
     request.setAttribute("result", "上传文件成功！");
    }
   }
  } catch (Exception e) {
   e.printStackTrace();
   request.setAttribute("result", "上传失败，请查找原因，重新再试！");
  }
  request.getRequestDispatcher("/pages/admin/annex-manager.jsp").forward(
    request, response);
 }

} 


下载（i/o流）无需导包：
import java.io.IOException;
import java.net.URLEncoder;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 * 下载文件
 * @author
 *
 */
public class DownloadFilesServlet extends HttpServlet {

 /**
  * 
  */
 private static final long serialVersionUID = 8594448765428224944L;

 public void doGet(HttpServletRequest request, HttpServletResponse response)
   throws ServletException, IOException {

  doPost(request, response);
 }

 /*
  * 处理请求
  * (non-Javadoc)
  * @see javax.servlet.http.HttpServlet#doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
  */
 public void doPost(HttpServletRequest request, HttpServletResponse response)
   throws ServletException, IOException {

  String name = request.getParameter("fileName");

  System.out.print("dddddddddd:" + name);
  // web绝对路径
  String path = request.getSession().getServletContext().getRealPath("/");
  String savePath = path + "upload";

  // 设置为下载application/x-download
  response.setContentType("application/x-download");
  // 即将下载的文件在服务器上的绝对路径
  String filenamedownload = savePath + "/" + name;
  // 下载文件时显示的文件保存名称
  String filenamedisplay = name;
  // 中文编码转换
  filenamedisplay = URLEncoder.encode(filenamedisplay, "UTF-8");
  response.addHeader("Content-Disposition", "attachment;filename="
    + filenamedisplay);
  try {
   java.io.OutputStream os = response.getOutputStream();
   java.io.FileInputStream fis = new java.io.FileInputStream(
     filenamedownload);
   byte[] b = new byte[1024];
   int i = 0;
   while ((i = fis.read(b)) > 0) {
    os.write(b, 0, i);
   }
   fis.close();
   os.flush();
   os.close();
  } catch (Exception e) {

  }

 }

}