Home/ Questions/Q 875553
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-15T11:17:21+00:00

I know, I know, title is quite bad, but I’ll try to explain what

  • 0

I know, I know, title is quite bad, but I’ll try to explain what I mean here. So, I ask my members to show their photos. They upload it somewhere, then paste their photos’ URL into input and I save it to my database (MYSQL). Then, the photo is being seen on their profiles. I get the URL from database and do something like that: <img src="<?=$photo;?>" height="123px" width="123px">"> where $photo is URL taken from MYSQL. Is it totally safe? Can somebody upload for example .php file and harm my website? Do I need to check if URL’s ending is .gif, .png, .jpg?
Thank you.

Edit: Yeah, of course I would protect my website from SQL injections and XSS attacks. But is there any way to harm my website in other way?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    What you described may be vulnerable to an XSS (Cross-site Scripting) attack. Essentially, a nefarious user may be able to inject javascript code that could do bad things, while executing as your site.

    For an example of this attack vector, check out: http://jarlsberg.appspot.com/part2#2__stored_xss_via_html_attribute

    EDIT: It sounds like you are already protecting yourself agains SQL injections and XSS, and you are wondering if there is some way for someone to inject PHP code into your site. I don’t think this is possible, since your server-side code will not be executing this string. You are simply instructing the client browser to download an image from a URL.

    It may be possible for someone to link to an image file that is infected with a virus, which would then infect other visitors to your site, but it would not affect the site itself.

    • 0