My two cents here:
I am refactoring a php application and I am trying to do has much
dependency injection as possible
You don't state if you are using a dependency injection framework. I think you definitely should. Use something that gives you the features you need: https://stackoverflow.com/questions/9348376/guice-like-dependency-injection-frameworks-in-php .
The problem I have now run into is at what point can I actually create
new objects? Its looking like I'll end up at a top level class,
creating loads of new objects as there is no where else to go. This
You normally use configuration or a central point for the instantiation of the initial objects that compose your application. The container will create the objects for you.
You then access objects (services, providers, controllers...) via the IoC container. It will transparently create an object for you if needed, or give you a reference to the appropriate existing instance.
Of course, inside your particular implementation of objects you can instantiate other objects on which you don't need DI (data structures, custom types, etc), but that's normal programming.
I've read some blogs that use factory classes to create all the
objects, and then you inject the factory into other classes. You can
then call the factory methods, and the factory creates the new object
Normally, you use a Factory if you want the IoC framework to instantiate some IoC objects through your factories (this is needed when instantiating a particular object requires some extra work). If you can simply create your objects with "new Object()", and setting some properties, you don't necessarily want to use a Factory pattern.
In other words, I'd say that using a Factory pattern for a class or group of classes depends on how you want to model those classes, not on whether you use DI (unless your DI implementation explicitly requires factories, which is unusual).
You also configure your IoC framework to use a Factory when you are using a 3rd party lib that already requires the usage of a Factory. In this case you have no control about this and you need to tell your IoC container: "hey, when I ask for one of these interfaces, you have to use this factory to provide me with an appropriate instance".
My concern with doing this is now my factory classes are going to be a
new free-for-all! I guess this may be ok as they are factory classes,
but are there some rules to stick to when using factory pattern and
DI, or am I going way off the mark here.
In this case, it sounds that you don't need to use Factory patterns for these objects/services/controllers/whatever, and you can simply configure your IoC to instantiate with "new" the appropriate class and inject everything else.
I hope it helps.