Preventing Access to Private Files

I understand how to use PHP with MySQL to have a members table to validate passwords. And to limit the generation of "member" pages to members only. But what about photographs? If someone knows the complete URL they could view it directly, unless the directory is protected using .htpassword But I don't want to have passwords in two places, nor muck with the password file everytime a new member joins. Suggestions? Thanks Stephen