You may defer creating the data to the second request, if you like: that means no temporary files, and that the IMG url needs to contain ebough info to *create* the image. Alternatively, you can have the first request create the image, store it somewhere (DB or file, doesn't really matter) and only communicate a request ID to the client, which is used to fetch the precomputed image.

You have to think a bit about security here, considering that the second request may need its own authentication so that other people can't "steal" somebody else's image. Also, there's a nice feature of using stored and precomputed images in that caching becomes very easy: *anyone* who requests an image with the paramaters that have already been computed (and optionally, who also passes authentication) will get the data very quickly. You can have a scheduled task that clears up old data from sotrage to prevent it from growing too large (or too stale).

One common way to do this is to save the image to a temp directory, then print out an <IMG SRC="..."> line that points to that temp file. Another process can periodically delete old images.

If you're feeling lucky, you could try using a data URL to embed the image directly into the HTML, but it's not supported in all browsers, and will only work for small files IIRC.