-2

This question already has an answer here:

An image can be displayed through a .php source if the source has a proper header (as per the answer to this question).

If a website allows something.php as the image source, and displays the image (as described above), is it possible to include some kind of javascript in something.php that will also run when the hosting site retrieves the image? (This seems like it could open things up to a possible XSS)

marked as duplicate by Arminius, Community Jan 31 '18 at 2:25

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • I don't see how PHP is relevant. What's the difference between serving a PHP script that returns JavaScript, and a file that is JavaScript? – multithr3at3d Jan 31 '18 at 1:07
  • @AndrolGenhald I'd say this is a duplicate, yeah. – AmagicalFishy Jan 31 '18 at 2:25
  • @multithr3at3d Because the website wouldn't allow something.js – AmagicalFishy Jan 31 '18 at 2:25
  • I don't think the file extension really matters... – multithr3at3d Jan 31 '18 at 2:38
0

To answer the question, no it is not possible.

Let's say the image is sourced as below for example.

<img src="http://somesite.com/something.php">

If something.php doesn't render as an image, the browser will display an [X] or not display the invalid/corrupt image.

If you throw in some javascript inside something.php will have no effect at all.

Not the answer you're looking for? Browse other questions tagged or ask your own question.