Now that I get to think about it, it was <ilayer> that we used, not img. The problem was with cookies, yes, and the easiest way was to use <ilayer> object with href to the script that returned HTML with a call to image.php. This script was the one responsible for detecting cookies and setting current image number for the user, passing it to the image script via _GET variable:
image.php?id=<image_id>
Otherwise I think you can have a table with user IPs to detect who's browser is asking for another image. All you need is a single record per user, valid for, say 5 minutes of idle time, after which the record would be invalid. You can "clean" such a table with a cron task, for example.
As for the sound, implement it the same way. I can't remember right now how to implement sound in Javascript (there is a single function call if I remember correctly), for example, but whatever you use (Javascript, Flash, or something else), whichever HREF you'd have to a sound file, have it to a PHP that outputs the content of the sound file, just mind the correct header mimetype output.
You can store images/sounds in the database (blobs), but I suggest against this. Store only filenames in the database, and you can protect the folder with images/sounds with a .htaccess file. You can access such files with
fopen ("http://username:password@yoursite.com/protected_folder/mediafile.mp3", "rb");
As a sidenote, when you pass large files, don't use passthru();. Instead, have a loop and fread() chunks of data and print() them back to user.
