If I understand right you question, you can upload pictures, rename it to format g564se9e.jpg, where name is generated and original. then write to mysql database which user is owner of this file. directory where thouse files will be stored must have permitions with RW only for one system user(as example myscriptuser). You must create functions for read or write pictures to storage with this user permitions.