I have a website that requires users to log in using a php access control script. It works great an users can't access any pages that contain the access control code.

One of the pages is a photo gallery, and I've noticed that if someone just types the direct URL of the photo, they can see the photo, even if not logged into my site. When I enable access control on the directory the photos are in through Abyss webserver, any links to the pictures in the directory require webserver username and password.

Is there a way to prevent access to my website's subdirectories to users who type the URL directly while still allowing the links on my access controlled pages to work?

Thanks...

yes by making .htaccess file under the directory you want to protect
may be this will help
http://www.javascriptkit.com/howto/htaccess3.shtml