Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
An image can be displayed through a .php source if the source has a proper header (as per the answer to this question).
If a website allows something.php as the image source, and displays the image (as described above), is it possible to include some kind of javascript in something.php that will also run when the hosting site retrieves the image? (This seems like it could open things up to a possible XSS)
To answer the question, no it is not possible.
Let's say the image is sourced as below for example.
<img src="http://somesite.com/something.php">
If something.php doesn't render as an image, the browser will display an [X] or not display the invalid/corrupt image.
If you throw in some javascript inside something.php will have no effect at all.
something.js