yes, the best idea is to store somewhere inaccesible via http. if you only have access to the web root, a .htaccess file will do as fine. in such case, put this on the .htaccess file:
order allow,deny
deny from all
VERY important considerations:
don't put any files that are not meant to be sent to the client on the directory you use to store the images, nor any of the subdirectories
you MUST check the request to make sure the client is not trying to access a file in another location (paths starting with "../" or "/")
you MUST send a header with the content type, otherwise the browser will fail to display most file types, if not all
you should also use caching, to avoid a hit on bandwidth
while you're at it, it's also a good idea to use $_SERVER['HTTP_REFERER'] to check for hotlinking
