I am building a web application where a user can update his avatar by uploading a picture from his computer file directory. Here's how I implemented it:
<input id="profile_pic" class="avatar-upload" type="file">
However, I have noticed that if a user changes type="file" to type="url", he will be able to upload a picture using any URL.
So is it a safe option or should I prohibit users to act so? How can this be exploited?