Tweeted twitter.com/#!/StackSecurity/status/539165604016832513
2 Fixed grammar and improved formatting
source | link

I am making one of mycreating a simple application. There is an option to download a generated image. For that, my phpPHP code is:

<?php
if (isset($_GET['img_name'])){
?>
<html>
<img src="<?php echo $_GET['img_name'];?> "></html>
<?php
}
?>

I know this is vulnerable for xssto XSS. But this is not the problem. Question is, is it possible for attacker to include or execute phpPHP file or code via this option application? I know that, for echo and img tag phpPHP will not execute here.

What you think researchers? Am iI safe  ?

I am making one of my simple application. There is an option to download generated image. For that, my php code is:

<?php
if (isset($_GET['img_name'])){
?>
<html>
<img src="<?php echo $_GET['img_name'];?> "></html>
<?php
}
?>

I know this is vulnerable for xss. But this is not the problem. Question is, is it possible for attacker to include or execute php file or code via this option ? I know that, for echo and img tag php will not execute here.

What you think researchers? Am i safe  ?

I am creating a simple application. There is an option to download a generated image. For that, my PHP code is:

<?php
if (isset($_GET['img_name'])){
?>
<html>
<img src="<?php echo $_GET['img_name'];?> "></html>
<?php
}
?>

I know this is vulnerable to XSS. But this is not the problem. Question is, is it possible for attacker to include or execute PHP file or code via this application? I know that, for echo and img tag PHP will not execute here.

What you think researchers? Am I safe?

1
source | link

php execution possibility in img src

I am making one of my simple application. There is an option to download generated image. For that, my php code is:

<?php
if (isset($_GET['img_name'])){
?>
<html>
<img src="<?php echo $_GET['img_name'];?> "></html>
<?php
}
?>

I know this is vulnerable for xss. But this is not the problem. Question is, is it possible for attacker to include or execute php file or code via this option ? I know that, for echo and img tag php will not execute here.

What you think researchers? Am i safe ?