Take a look at the users.getInfo API method . If a user installed your application or "connected" to Facebook on your site via Facebook Connect, you have access to profile information, which includes versions of their profile.
If you don’t have a session key for the user (that is, the user has not installed your application or connected via Facebook Connect), you can still get a “square” profile image, which is one of the smaller versions. You can request this directly using the API.
The easiest way is probably to use the fb tag : profile-pic and XFBML . You will need to install the Facebook Connect libraries for this, but you do not need the user to log in or something else to make XFBML work ... as long as you have the Javascript library on the page and the API Key to use, it will work .