diff --git a/main.py b/main.py
index e35a594..416284a 100644
--- a/main.py
+++ b/main.py
@@ -7,6 +7,7 @@ DB_LOCATION = (
 
 app = FastAPI()
 con = sqlite3.connect(DB_LOCATION)
+con.row_factory = sqlite3.Row
 cur = con.cursor()
 
 
@@ -36,7 +37,25 @@ async def next_picture(cookie: int):
     # take not rated picture from the database
     # do not insert anything in the database yet
     # return this picture
-    pass
+
+    # SELECT all images EXCEPT images with marks from the current session ->
+    # -> SELECT paths for these images
+    # FIXME[0]: can this be done better?
+    cur.execute(
+        """SELECT imgid, resizedpath
+                FROM images
+                WHERE imgid IN  (SELECT imgid
+                                    FROM images
+                                    EXCEPT
+                                    SELECT imgid
+                                    FROM marks
+                                    WHERE sessionid = :sessionid)
+                LIMIT 1
+    """,
+        {"sessionid": sessionid["sessionid"]},
+    )
+    r = cur.fetchone()
+    return {"picture_id": r["imgid"]}
 
 
 @app.get("/rate_picture/{session_id}/{picture_id}/{mark}")