The first ' opens a string. You're accidentally closing that string at $row[', causing an error. You need to either close your string earlier and echo $row['picture'] separately (see below), or use double quotes (") which allow for variable interpolation.
Also, a word of advice: Don't use concatenation (the . operator) when echoing in PHP. Echo accepts multiple comma-separated arguments which incurs none of the overhead of string concatenation:
echo '<tr><td><img src="images/', $row['picture'], '" alt="',
$row['username'], '" /></td>';
As a side note, the same applies to <?=, which is identical to <?php echo:
<?= $value, ' + 1 = ', $value + 1 ?>