How to secure SFTP against symlink attack?

The problem is that the symlink looks different in the chrooted environment and from the point of Apache/webserver view.

Unless the symlinks are necessary for the users, the obvious option is to forbid users connecting over sftp to create symlinks. You can do that using a parameter to sftp-server:

internal-sftp -P symlink