if your files are stored outside the www root.
then, you'll need to have enough permissions to access to the files.
Then, you could do something like :
<?php
$imageFileName = $_GET['image'];
$path = '/var/data/somewhere/';
$fullpath = $path . $imageFileName;
if (!is_file($fullpath))
{
die('Image doesn't exist);
} else {
$size = filesize($fullpath);
$content = file_get_contents($fullpath);
header("Content-type: image/jpeg");
echo $content;
}
Well, don't use this code in a production environement, since it's NOT SECURE.
You can use getimagesize() to check if it's an image.
Blacklist the phps extensions, etc...
Specify a working directory, to don't be able to use the backward ../../
file_get_contents()
EDIT :
About your comment about the symbolic link, if you have access to apache.conf file, you can specify an alias which points to another directory outside your webroot.