serve.php

<?php

function loadimg($img)
{
    //absolute path
    $fullPath = '/private/'.$img;
    if (is_readable($fullPath)) {
        $mime = mime_content_type($fullPath);
        header('Content-type: ' . $mime);
        header('Content-length: ' . filesize($fullPath));

        @readfile($fullPath);
        exit;
    }
    echo 'No Image';
    //or can return 404
    //header("Status: 404 Not Found");
    exit;
}

//test
$img = isset($_GET['img']) ? $_GET['img'] : '';
loadimg($img);