OK, here's the full code that creates the image password

I understand what you're getting at, but the code you show looks untested and buggy ($city is reset to the same value at the top of each loop), and there are some structural problems with the implementation -- like, what happens if two people are trying to log in at once? (Not to mention that a bot writer could easily checksum the renamed images to recognize them from prior requests.)

You could address the simultaneous-users issue by adding some kind of server-side storage with an opaque key for the session or attempt... Or take a look at how the other existing Captcha solutions handle this.