say I allow my users to embed images that others can view, then the user rewrites the image to be a PHP file for instance. Would that pose a security risk of him injecting something into my code?
Would that pose a security risk of him injecting something into my code?
If you allow your users to upload an image file with no 'robust' validation, it is trivial for an attacker to upload a malicious PHP file (e.g. by faking it as an image through changing the Content-Type request header) and execute it on your server or get a remote access.
Secure handling of File upload is not easy. You may find the below article helpful to know more about its security risks and recommendations:
There is no way a user can "rewrite an uploaded image to be a php file" because php files are recognized by it's .php ending not by its content.
But there are other aspects related to image upload that can be exploited. Displaying metadata without validating it for example can be a security risk. This would potentially allow an attacker to upload an image and inject client side parsed code into your website by modifying the metadata.
Yes it is possible. But not just xss. It can lead to remote command execution if image is uploaded your server. To prevent this always recreate any uploaded image to random named image files.