I would like to create a web site with many images. But I would like to protect against direct access to images, e.g. direct links to images without visiting the web site.>
You could use a PHP script to retrieve the images using something like:
and have the PHP script return the image data only after confirming that the domain of the HTTP_REFERER is your's.
If you have an account-oriented site, I suggest using PHP sessions as you stated and have the PHP script verify the session before returning the image data.